An AI agent carrying out research for an American company ended up accessing the systems of an IT services firm in Noida. The Indian firm did not notice. The AI developer discovered the intrusion and reported it. The incident was among those behind CERT-In's October 15 warning, and it raises an awkward question for startups: how much control do they have over the software now being allowed into their businesses?
For years, founders have connected payment gateways, customer databases and cloud servers to make operations faster. Now AI agents are being given access to those same systems to do work previously handled by employees. They can retrieve records, run code and take action without asking for approval each time. Startups see a chance to save on hiring, but each new permission creates another way for things to go wrong.
CERT-In found that agents being tested by AI developers had entered Indian organisations without permission, often through exposed passwords and poorly restricted cloud access. None of the affected companies detected the intrusions themselves. These were not necessarily agents installed by the victims, which makes the problem bigger than careless AI adoption. Even companies that do not use agents can be targeted by them.
The rush is already visible. A ServiceNow survey found 54% of Indian enterprises deploying AI agents, but only 22% with formal AI testing and audit processes. AI investment, meanwhile, rose 119% in a year. Companies appear more willing to pay for automation than for checking what it is allowed to do.
The consequences need not stop at leaked data. In a separate October 9 warning, CERT-In described attackers using stolen credentials to access payment systems at lenders and fintech firms and bypass transaction checks. It noted possible AI assistance, not confirmed autonomous attacks. IBM puts the average cost of an Indian data breach at ₹25.5 crore, rising to ₹40.9 crore in financial services.
Cybersecurity startups are seeing an opportunity. Funding for Indian companies in the sector reached $89 million in H1 2026, against $47 million a year earlier. CloudSEK works on finding threats; Securden is building controls over what agents can access. Yet Microsoft and Google are entering this market too, leaving little room for products that only offer basic safeguards.
Founders have been telling investors how much work AI can do without hiring people. They now need to show how they will stop it from doing work nobody authorised.
Let’s go through what else is happening in Indian startup world - Grab your simmering cup of StartupChai.in and unwind with our hand-brewed memes.
“Mai Zindagi Ka Saath Nibhata”: CoinDCX Admits Losses
CoinDCX says it absorbed losses after deposits sent to discontinued wallet addresses exposed a gap in its security process.
The crypto exchange denies any breach of active wallets, but the incident raises questions about its handling of old addresses.
Read more here
“Move On Kar Liya”: Swiggy To Begin Instamart Inventory Model Transition
Swiggy plans to shift Instamart to an inventory model by mid-Q3 FY27.
The move will give it greater control over pricing, products and availability.
Red more here
“Hum Bhi Hain Josh Mein”: ZFunds Launches US Stocks And ETFs
Wealth-management platform ZFunds has launched access to US-listed stocks and exchange-traded funds, opening around 5,000 accounts on the first day. Customers can invest in companies such as Apple, NVIDIA, Amazon, Microsoft, Meta and Berkshire Hathaway.
The offering brings global securities into ZFunds' wealth-manager-led model.
Read more here
“Humein Bhi Same to Same Chahiye”: Motilal Oswal, Calliope Apply For Ola Shares
Motilal Oswal and Calliope Capital applied for 2.39 Cr Ola Electric shares on day one of its rights issue.
Both exercised rights transferred by promoter group entities.
Read more here
“Panopticon Bhi Sharma Jaayega”: WhatsApp, Telegram SIM-Binding Mandate To Take Effect From January 1
WhatsApp and Telegram will enforce SIM-binding rules from January 1, 2027, linking accounts to registered SIM cards. The requirement stems from directions under the Telecom Cyber Security Rules, 2024.
Users without the linked SIM may face restrictions, while web sessions could be logged out.
Read more here
“Purana Saal Naya Maal”: Ultraviolette Launches New E-Bike
Ultraviolette has launched its X-47 Venom electric bike at ₹2.65 lakh, powered by its new VX-100 platform.
The startup is also gearing up to expand into electric scooters.
Read more here
“Tu Mera Mai Teri”: Boxtron Acquires Wooden Balance-Bike Brand Tipayi
Pune-based industrial packaging and logistics company Boxtron has acquired Tipayi, maker of a three-in-one wooden balance bike for children.
Boxtron founders Viraj Parakh, Swapnil Potnis and Rohan Konde plan to take founder Prem Kale's brand into its next phase through market expansion.
Read more here
“Shukriya Meherbani Karam”: Honasa Elevates Vipul Maheshwari
Honasa Consumer has elevated Vipul Maheshwari to chief product and technology officer, effective October 23.
He previously served as executive vice-president of product and data and has spent six years building the company's data and product capabilities.
Read more here
