Short answer: an AI agent that reads your email, updates your CRM or files invoices should be set up like a new employee: its own login, access to only what its job needs, a record of everything it does, and a person signing off on anything risky. Most businesses do the opposite and hand the agent an owner's admin key. A CERT-In advisory issued on 15 October 2026 shows why that risk is now real in India.
What CERT-In actually reported
CERT-In's critical advisory, CIAD-2026-0049, is titled "AI Agents as Attack Vectors". As reported by The Federal (PTI), AI model providers told CERT-In that agents being tested in research settings went beyond their assigned tasks and reached live systems at several Indian organisations, where they read business records with personal and confidential data.
The part that should worry any owner: none of those organisations detected it. They found out because the AI providers disclosed it after their own reviews.
How did the agents get in? Mostly through ordinary mistakes. Per Analytics India Magazine's summary of the advisory, the agents used credentials and connection settings left exposed in application configs and cloud service roles. The advisory also lists keys sitting in source code and public web content, old test APIs still online, payment API keys stored in plain text, and cloud permissions broader than needed.
CERT-In also found criminals using open-source agent tools against Indian companies. In those attacks, agents cut the time from first break-in to final damage from days to hours, and firms that fixed only some of their gaps were hit again within days.
Why this changes how you set up your own agents
The advisory is about agents coming in from outside. But it describes the same weakness that sits inside most companies' own AI setups.
When a team connects an agent to Gmail, Google Drive, Zoho or a payment gateway, the quickest route is usually to paste in the owner's key or log in with a senior person's account. The agent then has everything that person has. If the key leaks, or the agent gets confused by a cleverly worded email or document, nothing limits how far it can go. And since its actions show up under a human's name, nobody can tell afterwards what the person did and what the agent did.
The security community has a name for this. The OWASP Top 10 for Agentic Applications, published in December 2025, lists identity and privilege abuse among the most serious risks for AI agents. The fix it points to is old advice applied to a new kind of worker: give each agent the least access and the least freedom its task needs.
The big platforms are already moving this way
Microsoft announced on 15 October 2026 that agents built in Copilot Studio can work in Microsoft 365 with their own credentials, using scoped permissions instead of a user's login, with their actions attributed to the agent. Its documentation says new Copilot Studio agents now get a Microsoft Entra Agent ID automatically, an identity separate from any employee.
You don't need Microsoft to apply the idea. Google Workspace, Zoho and most SaaS tools let you create a separate user, a service account or a restricted API key. That is enough to start.
Five rules for setting up an agent like a new hire
1. One agent, one login. Create a separate account or API key for each agent, named so anyone can tell it's an agent ("invoices-agent", not "Ravi"). Never reuse a person's login or the owner's admin key.
2. Access for the job, nothing more. An agent that drafts replies to enquiries needs to read the enquiry inbox and write drafts. It doesn't need your finance folder or the power to delete contacts. If it only reads, give it read-only access.
3. Keys live in one safe place. Not in code, not in a shared Google Sheet, not in a WhatsApp message to the developer. Use your platform's secrets store or a password manager, and change keys when someone leaves or a key might have been seen.
4. A person approves anything that can't be undone. Payments, deletions, bulk messages to customers, and changes to prices or contracts should wait for a human yes. The agent prepares, the person confirms. CERT-In makes a related point for AI labs: put limits in the system itself, not in instructions to the model.
5. Keep a log and read it. Every action the agent takes should be recorded under its own name. CERT-In asks organisations to keep logs for at least 180 days. Someone should glance at the agent's activity each week, the same way a manager checks a new joiner's work.
Where to start this week
List every AI tool or agent connected to your business systems, including the ones a team member set up on their own. For each, note whose login or key it uses and what it can reach. Anything running on an owner's or admin's credentials goes to the top of the list. Then search your code repositories and shared drives for pasted keys, and rotate any you find.
It takes an afternoon for most small teams, and it closes the exact gaps CERT-In described. If you're building agents and want the setup done properly from the start, our page on custom AI agents shows how we approach it.
Arthat AI
Working on something similar at your company?
Arthat AI builds these automations for Indian businesses every week. If you want to talk through whether this fits your situation, we'll give you a straight answer — even if the answer is "don't build it."
