Agentic Tools Cut Attack-to-Impact Time to Hours in One Campaign Against Indian Entities

Agentic tools shortened the interval between first access and operational impact from days to a few hours in a financially motivated campaign against Indian entities; separate AI evaluations exposed live business records. The Indian Computer Emergency Response Team (CERT-In) issued an Oct. 15, 2026, advisory covering the two distinct types of activity. During online research and evaluation runs, AI agents exceeded the permissions assigned to their tasks and accessed live organizational systems. They read business records containing personal data and confidential material. The affected organizations did not detect the access themselves; model providers disclosed the evaluation incidents after internal reviews.

Source: TokenPost