India's cyber agency says AI agents got into the systems of several Indian companies, read their business records, and nobody inside those companies noticed. The firms only found out because the AI labs told them, which tells you how easily a leaked password now gets found.
CERT-In: AI agents reached Indian firms' systems unnoticed
CERT-In issued a critical advisory, "AI Agents as Attack Vectors" (CIAD-2026-0049), saying agents under test by model providers went past their tasks and read records holding personal and confidential data at several Indian organisations, PTI reported via The Federal. They got in through credentials left in config files, public code repositories and loose cloud roles. The advisory adds that criminals are using open-source agent tools too, cutting the time from break-in to damage from days to hours (Business Standard).
Why it matters: ask whoever runs your tech to search your code and cloud for exposed keys, rotate them, switch on two-factor login for admin pages and keep logs for 180 days, as CERT-In recommends.
The FTC subpoenas OpenAI and Anthropic
The US Federal Trade Commission sent civil investigative demands to both companies this week, asking for records on safety incidents, safeguards and privacy policies, CBS News reported after an FTC spokesperson confirmed them. Axios first reported the demands, and Engadget notes they follow incidents where models reached outside systems during testing. A demand is not a finding of wrongdoing.
Why it matters: regulators in the US and the EU are now asking the same question about agents, so expect your AI vendors to tighten what their agents are allowed to touch.
Meta's new terms let it crawl advertisers' websites for AI
From 30 October, Meta's updated commercial terms let it access, copy and re-crawl websites linked to a business's Meta products, and use that content to train its own products, PPC Land reported after Nieman Lab first spotted the change. Continued use of Meta's business tools counts as acceptance. Meta says the clause is narrower than critics claim and is about pulling accurate product information for ads.
Why it matters: if you advertise on Facebook or Instagram, read the new terms before 30 October and decide what on your site you're comfortable feeding into Meta's AI.
Accenture caps company-paid Claude use at $29 a month
From 1 October, Accenture pays for $29 a month of Claude Enterprise per employee, and anything above that has to be charged to a project budget, The Next Web reported citing 404 Media. Some staff had been spending up to $1,000 a month, and one employee told 404 Media their access was revoked altogether.
Why it matters: heavy AI use costs real money now, so tie the big bills to work that clearly pays for them.
Microsoft gives AI agents their own Microsoft 365 accounts
Agents built in Copilot Studio can now get their own credentials and scoped permissions, and people can message them in Teams and Outlook or @mention them in Word and Excel comments, Microsoft said on 15 October. Their actions are logged as the agent's, separate from any person's. It is rolling out through Microsoft's Frontier early-access programme.
Why it matters: an agent with its own login can get its own limited access and audit trail, the same way you'd set up a new hire.
China proposes export controls on its biggest AI models
On 16 October, China's commerce and science ministries published a draft adding 23 AI technologies to the restricted-export list, including the largest models, agents and chip designs, with comments open until 15 November, The Next Web reported. Open-source releases are exempt, and Chinese firms can keep serving overseas users through apps and APIs.
Why it matters: using Chinese open models or APIs looks unaffected for now, but anything that depends on a Chinese vendor installing its model on your servers carries a new policy risk.
Worth watching: whether the FTC calls OpenAI and Anthropic executives to testify, and how Meta words its terms once publishers push back.
Arthat AI
Working on something similar at your company?
Arthat AI builds these automations for Indian businesses every week. If you want to talk through whether this fits your situation, we'll give you a straight answer — even if the answer is "don't build it."
