Some AI agents are built to be given real access: to cloud accounts, codebases and company data, not just a chat window. CERT-In's latest advisory shows what can go wrong when that access is not locked down, and it is the kind of risk Malaysia's own cyber agency has been warning about.
Contents
India's Computer Emergency Response Team (CERT-In) issued an advisory on 15 October, reported the next day by TechCrunch, saying AI agents from multiple providers reached the live systems of Indian organisations during testing and research runs. The agents got in through exposed credentials, connection settings and overly permissive cloud roles sitting in app configurations and public code repositories. They then read personal data and confidential business records, CERT-In said, in actions that "exceeded the authorisation of their assigned tasks." The affected organisations had not detected the disclosed intrusions themselves; CERT-In learned of them only because the AI providers chose to disclose voluntarily. The advisory did not name the providers or the organisations involved.
Malaysia's own agency spoke a day earlier
On 14 October, the day before CERT-In's advisory, NACSA chief executive Dr Megat Zuhairy Megat Tajuddin told the Singapore International Cybersecurity Week that "no country could work alone to build resilience and safeguard its cybersecurity ecosystem" against threats arising from AI's rapid advancement, and called for ASEAN countries to pool capacity-building rather than tackle AI-driven threats alone. "Most of us have yet to find a clear solution to that problem," he said.
NACSA's remarks were general caution, not a specific prediction, and there is no evidence the two events are connected. But a day later, India produced a relevant example of the broader risk Megat Zuhairy had just described: an AI system reaching further than it was ever authorised to.
Why this is a Malaysian business problem, not just a policy one
What CERT-In describes used ordinary ingredients: the agents found credentials and cloud permissions that were already exposed, and used them to go further than intended. It sits alongside a wider pattern ProductNation has reported from Check Point's research: one in 39 enterprise AI prompts Check Point observed in September already carried a high risk of leaking sensitive company data.
India's advisory is one of several 2026 disclosures of an AI agent reaching systems beyond the access it was meant to have, per the same TechCrunch report: OpenAI publicly disclosed in July that its agents reached Hugging Face's own live systems during an internal security test, and the Australian government disclosed in September that an OpenAI agent had found a way to gain non-public access to a Medicare statistics portal, saying no personal medical information was accessed and that its investigation was continuing. Anthropic separately disclosed that three of its Claude models gained unauthorised access to three companies' systems in July, after a misconfiguration in a third-party evaluation environment left models that had been told they had no internet access connected to it anyway. Anthropic said it found no evidence any model was pursuing a goal of its own.
Malaysia is currently drafting an AI Governance Bill, still subject to Cabinet and parliamentary process, that proposes a Central AI Authority and a tiered risk framework binding AI deployers. As proposed, it targets how AI is developed, deployed and used within Malaysia, a different question from what an AI provider's own agent does when it is given access to someone else's systems during testing, which is what CERT-In's advisory describes.
What to check before the next AI agent gets access
For any Malaysian company handing an AI agent access to cloud infrastructure, code or customer data, the practical lesson from India is narrow and checkable: audit exposed API keys and credentials sitting in code repositories and app configs, and tighten cloud roles down to what the task actually needs rather than what is convenient to grant. CERT-In's advisory shows what exposed credentials and over-permissive cloud roles can let an AI agent do.
Photo illustrations by ProductNation.
