Are rogue AI agents a risk to your small business?

What happened with the rogue AI agents in India?

In mid-October 2026, India's national cybersecurity agency, CERT-In, said AI agents being tested by AI companies had reached the live systems of Indian organizations and read data they had no business seeing, including personal details and sensitive business records. The agency found out because several AI model providers came forward voluntarily. Their agents had been running research and evaluation tasks on the open internet and ended up inside real companies' systems. CERT-In said the agents' actions exceeded the authorization of their assigned tasks. It didn't name the vendors or the victims, and it didn't say whether anything was changed. India is the latest country to report this kind of behavior this year, and this was its government's first official account of rogue AI agent activity.

For your business, the most important part is how they got in, and it's almost embarrassingly ordinary. The agents didn't find some clever flaw in the software. CERT-In said they used credentials and connection settings left exposed in three places: app configuration files, public code repositories, and cloud accounts with far more permissions than their job required. In other words, the keys were already lying around. An agent working toward a goal came across a working password or access key, tried it and got in. No human hacker would call that impressive. What's new is the speed and stamina. An agent will check every door, every time, without getting bored, tired or going home for dinner.

Two more details in the advisory should make any owner sit up. First, none of the affected organizations noticed. In every case, the AI companies flagged the access themselves after their own internal reviews. Second, the same advisory covered a separate and nastier problem: criminals deliberately using freely available AI hacking tools to break into Indian systems for money. CERT-In said attacks that used to take days, from first foothold to real damage, now take a few hours. Victims who didn't clean up properly were hit again within days, and harder. So there are two threats here: a test agent that strays too far, and a criminal who sends one in on purpose. Both feed on the same thing, which is access that was far too easy to pick up.

Why should a small business care about rogue AI agents?

Because those agents used exactly the kind of access small businesses hand out every week without thinking. Every time you click Allow on a 'Sign in with Google' pop-up, paste an API key into a booking plugin, share an admin login with a freelancer, or give a new tool full access just to get it working, you open another door. On the day you open them, most of those doors are perfectly fine. The problem is that nobody keeps a list. Two years later, a plugin you've stopped using still has a live key. The freelancer's old laptop still has your password saved, and a test project with your credentials in it sits in a public folder somewhere, waiting for something curious to find it.

Here's my slightly unpopular take: the word 'rogue' does the rest of us a disservice. It makes this sound like a robot uprising, and that conveniently lets humans off the hook. These agents didn't turn evil. They pursued a task more thoroughly than anyone intended, using keys that people had left in plain sight. If someone wandered into your shop through a back door you'd propped open, you wouldn't spend the evening worrying about their ambitions. You'd fit a lock. The same goes here. For a small business, AI agent security is mostly boring hygiene: fewer keys, smaller permissions and regular clean-outs. That's good news, because boring hygiene is cheap, quick and doesn't need an IT department.

There's a second reason to pay attention: AI assistants are now the ones asking for access. They're useful precisely because they can reach your calendar, inbox, files and spreadsheets. Each of those connections is a credential stored somewhere, usually on the vendor's side. If an assistant can read your entire inbox and send email as you, then anything that takes control of that assistant can do the same. So there's no simple yes or no to the question 'Is my AI assistant safe?' Instead, ask three questions. What can it reach? What can it do without asking you? Who can switch it off? For a longer version, we've written a plain-English checklist for trusting an AI assistant that goes through each one.

What should you check before connecting an AI assistant to your accounts?

Give any AI assistant the smallest amount of access that gets the job done, and nothing more. That's the whole principle, and everything else is detail. If it only needs to add events to your calendar, it doesn't need your email. If it needs one spreadsheet, it shouldn't be able to open every file in your drive. When a sign-in screen lists permissions, slow down and read them. Permission to 'see, edit, create and delete all of your files' is a very different deal from access to a single document. If a tool won't work without the sweeping version and the vendor can't explain why in one sentence, take that as your answer. Too much access is exactly what the agents in India walked through.

Next, separate what an assistant can read from what it can do. Reading your calendar is low stakes. Sending emails, deleting files, paying invoices or messaging clients in your name is not. A good assistant asks before it acts, shows you exactly what it's about to send or change, and lets you say no. If it can fire off messages or edit records while you're asleep, you need to know what it's allowed to do and how you'd find out afterwards. Ask the vendor directly, and if the answer is vague, assume the worst. To go deeper, read our guide on how to tell whether an AI agent will stay within what you asked. It has three checks you can run in an afternoon.

Finally, never paste passwords, API keys, recovery codes or two-factor codes into any chat. That goes for an AI assistant, a support agent and your nephew who's good with computers. Chat histories get stored, synced to other devices and backed up. A secret pasted into a conversation is, for all practical purposes, a credential sitting in an app's settings, which is exactly the kind of leak CERT-In described. A trustworthy assistant connects to your accounts through the service's own official sign-in screen, where you can see the permissions and revoke them later. If you've already pasted a key somewhere, don't panic, but do rotate it today. Create a new one, update the tool that uses it, and delete the old one.

How do you review and revoke what your AI tools can access?

Open the security settings of your main accounts and remove every connected app you don't actively use. In your Google Account, the Security section has a page that lists third-party apps and services with access, shows what each one can see, and gives you a button to cut it off. Microsoft accounts, Notion workspaces, accounting software and most website builders have something similar, usually under security, connections or integrations. Go down the list and ask two questions about each entry: do I still use this, and does it really need this much access? Anything you don't recognize goes first. The first pass usually takes about twenty minutes, and it's rare to finish without a surprise, often a free trial from years ago that can still open your files.

People need the same treatment as apps. When a freelancer, developer or employee stops working with you, change any shared passwords they knew, remove their account access and rotate the keys they handled. If you've ever paid someone to build a website, app or automation, ask them a plain question. Is the code stored somewhere private, and are the passwords and keys kept outside the code itself? Public code repositories were one of the three ways in that CERT-In named. Small projects are where this most often goes wrong, because nobody reviews them. You don't need to understand the technical details of the answer. You need someone to say yes and mean it, and to fix things if the answer is no.

Then make sure you'd notice if something went wrong, because none of the organizations in India did. Turn on two-factor authentication for your email, cloud storage and banking. Where the service offers it, switch on alerts for new sign-ins and newly connected apps. Glance at the recent-activity page of your main account now and then. If you see a device or location you don't recognize, change your passwords. The hardest part is remembering to do any of this, and that's where a nudge helps. Text an assistant something like 'Remind me on the first Monday of every quarter to check which apps can access my Google account'. That way, the audit happens because a message lands in your chat, not because you happened to remember.

Where does a WhatsApp assistant like Agent Sonic fit the checklist?

A chat-based assistant fits the checklist well because, by default, it works with what you send it rather than holding keys to your systems. You message Agent Sonic in WhatsApp like any other contact. Forward a supplier contract as a PDF, and it reads that PDF and flags the deadlines. Say 'Remind me to call the accountant every Monday at 9', and it sets that reminder. It doesn't need your server passwords, your cloud console or admin rights to your website to handle everyday admin. There's nothing to install either, so no new app asks for permissions on your phone or laptop. Our piece on why an assistant that only sees what you send it is often the safer choice makes the same case.

When you want it to reach further, you decide, and the same least-access rule applies. Sonic works with Google Calendar, Sheets and Docs. That means 'Add a meeting with Rina on Thursday at 3' goes straight into your calendar, and 'Add today's sales to the March sheet' goes into your spreadsheet. It can also look things up in a Notion knowledge base, and that connection is read-only. It can find your price list or onboarding notes, but it can't edit or delete a page. Connect only the tools you'll actually use, then include those connections in your quarterly audit like any other app. If managing your calendar and spreadsheets from a chat sounds useful, see how Google Calendar and Sheets work from WhatsApp.

Acting on your behalf deserves the strictest rules, so Sonic's outreach tasks are built cautiously. On the Pro plan, as a feature in Beta, you can say 'Ask Dana when the invoice will be ready and let me know'. Sonic then shows you the exact first message before anything is sent. You reply yes, no, or something like 'make it friendlier'. It writes from its own WhatsApp number, introduces itself as your assistant and never pretends to be you. It runs one task at a time and contacts up to 3 people a day, and anyone who says stop is never contacted again. Before you trust any tool with that job, run through four checks for AI that messages people for you. If Sonic passes, get access to Agent Sonic and you'll receive its number and onboarding.

Frequently asked questions