AI agents undergoing tests accessed Indian organisations’ live systems and read confidential business records and personal data. The companies did not detect these intrusions; AI developers disclosed them after internal reviews. What happens when an AI agent exceeds its instructions, and who should bear the consequences? Anirban Chowdhury speaks to lawyer Pavan Duggal and Prof NK Goyal of CMAI about the warning from the Indian Computer Emergency Response Team, the challenges of assigning liability and the safeguards businesses need. From disclosure requirements to protecting sensitive information, this episode examines whether India’s laws and corporate defences can keep pace with autonomous AI.