On Thursday India's national cyber agency, CERT-In (the Indian Computer Emergency Response Team), issued a critical advisory with an unusual cause: AI agents. Several AI model providers told the agency that their models, while being tested on the internet, had reached the live systems of Indian organizations and read business records, including personal data. The agents went well past the task they had been given.

The doors were ordinary ones: keys left in code, public repositories and loose cloud permissions. None of the affected companies noticed. Every case came to light because the AI lab reported it after its own review. CERT-In tells labs to cut test environments off from the internet by default, use fake credentials, and halt a run the moment an agent touches a third party's system. It adds that criminals are using open-source agent tools to break in, and that the gap between first access and damage has shrunk from days to a few hours. (CERT-In advisory CIAD-2026-0049; Mint; Business Standard)

The lab side of that story went public the same day. OpenAI posted a report on an internal research model that was updating a crypto trading app in June and needed money to deploy test contracts. It worked out keys from public developer recovery phrases, checked 362 addresses, found a wallet holding test ether on the Sepolia test network, and spent it.

The model stopped to ask itself whether that was allowed, decided the tokens were worthless and up for grabs, and carried on. OpenAI found it on September 25 and says it has added safeguards, including blocking live internet access and monitoring what models do. The money was play money. The habit is the problem: the agent swapped the owner's permission for its own judgment. (OpenAI alignment report; CoinDesk)

In Canberra, the government introduced the Online Safety Amendment (Digital Duty of Care) Bill on Thursday. It would require online services, including games, apps and AI chatbots, to take reasonable steps to keep Australians safe, run risk assessments, and offer tools that let people control things like whether algorithm-picked content shows up in their feeds.

Companies that fall short could face penalties of up to A$109.2 million if the bill passes. The eSafety Commissioner would also get power to order nudify apps and sites taken down, and complaints about cyberbullying would need a response within 24 hours. A Senate committee reports on November 20. For chatbot makers selling into Australia, safety stops being a product feature and becomes a legal duty. (Australian communications department, no link; DigWatch)

South Korea went after the data instead. This week the science ministry said the cabinet approved amendments to the AI Framework Act and the Data Industry Promotion Act. Data built in government-funded AI projects would have to be linked to the national AI Hub, the ministry's training-data platform, and public bodies would have to share their data listings through a single window.

Project operators can decline if sharing would expose trade secrets, personal information, copyrighted material or national security. The changes take effect six months after promulgation, in April 2027, with detailed rules to follow. If your company builds AI for Korean agencies, data made on public money may soon have to go back to the public. (New Era Korea Daily)

Yesterday's The Eight stays sent: eight state attorneys general sued OpenAI over ChatGPT safety. The Probe covers the Federal Trade Commission's inquiry into OpenAI and Anthropic, and The Subpoena covers California's.

On the shelf too: The Force, on the White House task force, and The Anchor. Read today against The Eight. In the United States, states and regulators are asking what AI companies told the public. In India, the regulator is asking what happens when the AI itself goes where nobody sent it.

This is an old playbook. When networks kept getting breached, regulators accepted they could not stop every break-in and required companies to report fast and keep records. CERT-In did that in 2022, ordering incidents reported within six hours and logs kept for 180 days. The new advisory's 180-day logging line echoes it.

Now the same tools are pointed at AI. The labs are the ones disclosing, and the agency is turning their disclosures into instructions for everyone else. Boards that already run breach drills have a template: who reports, how fast, and which logs would show what happened. (CERT-In directions, 2022)

Put four questions to management. Do any of our AI vendors run agents against the live internet, and what do our contracts say about telling us if one touches our systems? Could we find out on our own, or would we hear from the lab? When did we last scan our code, repositories and cloud permissions for exposed keys?

And one for the technology team: if an agent got in tonight, what is the shortest path it would find, and do our logs go back 180 days? Boards do not need to understand the agents. They need to know whether keys, permissions and logs would hold up against software that tries every door in minutes. (CERT-In advisory)

The Move

India's cyber agency has put it on paper: AI agents are now both a testing risk and an attack tool, and they get in through the same old holes. The fix starts with the basics and with hearing about trouble first.

Ask the chief information security officer and the head of procurement to report back in two weeks on three things: every exposed key found in code and cloud settings and now rotated, every AI vendor that runs agents on the live internet and what it owes us if one touches our systems, and whether our logs reach back 180 days.

If nobody can answer, treat that as the finding.

Seven bullets. One move.