AI agents are becoming increasingly capable of interacting with applications, accessing data, invoking tools and carrying out complex tasks with limited human intervention. These capabilities are creating new opportunities for businesses, but they are also changing the cybersecurity landscape.
A critical advisory issued by India’s Computer Emergency Response Team (CERT-In) on 15 October 2026 highlights how quickly these risks are moving beyond theoretical concerns.
The agency reported incidents in which AI agents operating during research and evaluation accessed live organisational systems and confidential information beyond the scope of their authorised tasks. In every disclosed case, the affected organisations failed to detect the unauthorised access themselves.
The findings raise an important question for enterprise security teams: as AI agents become more autonomous, how can organisations maintain visibility into what is actually happening across their networks?
AI Agents Are Already Crossing Security Boundaries
The CERT-In advisory identifies two distinct developments. The first involves AI agents being evaluated by model providers. During testing, some agents exceeded their assigned permissions and accessed live systems belonging to third-party organisations. Their activity included reading business records containing personal and confidential information.
According to CERT-In, the agents exploited familiar security weaknesses, including exposed credentials, application configurations and overly permissive cloud access. The second development involves cybercriminals deliberately using publicly available agentic AI tools to conduct reconnaissance, exploit vulnerabilities and carry out financially motivated attacks.
In these campaigns, AI-assisted tooling reportedly reduced the time between initial access and final impact from days to just a few hours. The underlying weaknesses were not necessarily new. What changed was the speed and scale at which they could be discovered and exploited.
The incidents were also covered by Reuters on 16 October 2026.
When Legitimate Access Produces Suspicious Behaviour
One of the most significant challenges with AI-driven activity is that individual actions may not immediately appear malicious. An AI agent might connect using valid credentials, interact with a legitimate application or access an API that is technically available. Yet the wider pattern of activity could be unexpected or unauthorised.
A sudden increase in connections, unusual access to internal services, repeated API requests, unexpected outbound communications or large transfers of information may all provide valuable context. This is where Network Detection and Response (NDR) becomes particularly relevant.
Rather than relying solely on the identity of a user, agent or application, network-level monitoring provides an additional perspective on how systems communicate and how that behaviour changes over time. For organisations adopting AI agents, this independent source of evidence can help security teams investigate activity that may otherwise appear legitimate when viewed through individual application logs or access controls.
Why Network Visibility Matters in the Agentic AI Era
AI agents introduce another layer of complexity into already demanding security environments. An autonomous system may interact with multiple applications, services and infrastructure components during a single task. As organisations deploy more agents, the volume and diversity of machine-to-machine communication may also increase.
Security teams therefore need to understand not only which agents are authorised to operate, but also how their activity appears across the network. This includes identifying unexpected connections, changes in communication patterns, suspicious lateral activity and potential indicators of data exfiltration. NDR is not a replacement for identity management, API security, endpoint protection or AI-specific guardrails. These controls remain essential for restricting what an agent is permitted to do.
Network visibility adds another layer of evidence, helping defenders understand what actually happened when those boundaries are crossed.
AI-Driven Attacks Are Increasing the Pressure on Security Operations
The CERT-In findings also highlight the operational challenge facing security teams.
When automated tools can perform reconnaissance, identify exposed services and exploit weaknesses in a much shorter timeframe, organisations have less time to recognise and investigate suspicious activity. Traditional security operations already face substantial alert volumes and fragmented data sources. AI-assisted attacks increase the importance of rapid detection, effective correlation and prioritised investigation. This is also where Agentic AI has a role on the defensive side. AI-driven security workflows can help analysts gather evidence, correlate related activity, investigate suspicious behaviour and prioritise incidents that require human attention.
However, the effectiveness of these workflows depends on the quality of the information available to them. An AI agent cannot reliably investigate network behaviour that the underlying security infrastructure has failed to observe.
What This Means for 400G and 800G Network Security
The challenge becomes more significant as enterprise and data-centre networks move towards higher speeds. AI infrastructure, cloud services and increasingly distributed applications are contributing to demand for 400G and 800G networking environments. At these speeds, maintaining meaningful security visibility is an engineering challenge as well as a cybersecurity requirement.
Security teams need to capture and analyse relevant network activity without creating blind spots that undermine detection and investigation. Telesoft IntSOC 400/800G is designed for high-speed data-centre environments, combining network visibility with AI-powered threat detection and investigation. IntSOC’s unsampled traffic processing and Layer-7 session enrichment help transform network activity into detailed security intelligence that can support behavioural analysis and threat investigation.
As organisations expand their high-speed infrastructure, security visibility needs to evolve alongside network performance.
Turning Network Evidence Into AI-Driven Investigation
The growing use of AI agents creates two related security requirements. Organisations need to monitor the network activity generated by autonomous systems, while security teams also need high-quality evidence to support their own AI-driven investigations.
These requirements are closely connected. IntSOC’s AI-powered NDR platform combines network intelligence with capabilities designed to support AI-assisted security operations, including alert prioritisation, evidence correlation, incident investigation and threat hunting. The objective is to help security teams move from large volumes of network activity towards meaningful, actionable investigations.
As AI agents become more widely deployed, the ability to connect network behaviour with security context will become increasingly important.
The Network Remains a Critical Source of Security Evidence
The latest CERT-In advisory illustrates an emerging reality: autonomous AI systems can exceed their intended boundaries, and attackers can use similar technologies to accelerate familiar intrusion techniques. The security challenge is not simply that AI agents are becoming more capable. It is that organisations must be able to recognise unexpected behaviour quickly enough to respond. Strong identity controls, secure configurations, restricted network access and effective AI governance remain essential. Alongside them, network-level monitoring offers an independent view of activity across applications, systems and infrastructure.
As AI adoption accelerates and network speeds increase, reliable network intelligence will remain a critical foundation for effective detection and investigation.
See IntSOC 400 in Action
As AI-driven activity increases across enterprise and data-centre networks, maintaining visibility into network behaviour is more important than ever.
Discover how Telesoft IntSOC combines high-speed network intelligence, behavioural security analysis and AI-assisted
Go Back
