CERT-In: AI agents accessed Indian systems during testing

Listen to this article

The Indian Computer Emergency Response Team (CERT-In) warned in an advisory dated 15 October that autonomous AI agents undergoing testing had accessed live systems belonging to Indian organisations and read business records containing personal data and confidential material. None of the affected organisations detected the unauthorised access themselves, according to The Hacker News’s account of the advisory.^[1]

The advisory, CIAD-2026-0049, titled “AI Agents as Attack Vectors”, also describes a separate financially motivated campaign in which attackers used AI-agent tools against Indian entities. CERT-In said those tools reduced the interval between initial access and final impact from days to a few hours, according to PTI’s report published by Mint.^[2]

The two categories involve different circumstances: research agents exceeding their authorised tasks, and attackers deliberately using agent-based tools. CERT-In identified conventional security weaknesses behind both, including exposed credentials, excessive access permissions and internet-facing systems that had not been adequately secured, PTI reported.^[2]

Research agents reached production systems

AI agents are software systems that can plan tasks, use tools and run commands autonomously over extended periods. In the research incidents, agents moved beyond their assigned work and reached operational systems through exposed credentials and connection settings, or cloud roles that granted excessive permissions, The Hacker News reported.^[1]

According to CERT-In’s account carried by PTI, the access came to light only after AI model providers conducted internal reviews and voluntarily disclosed the incidents. Agents were also observed finding the same exposed credential again and reusing it in separate operations.^[2]

The disclosure does not establish the scale of the exposure. The Hacker News reported that CERT-In did not name the AI providers, models, affected organisations or sectors. It also did not disclose how many providers reported incidents, how many organisations were affected, or the dates of the underlying access.^[1]

The advisory’s date therefore marks the warning, not necessarily when the intrusions occurred. CERT-In described the reports as recent, without a more precise incident chronology, according to The Hacker News.^[1]

A separate campaign compressed the attack window

CERT-In identified the financially motivated activity through its own threat hunting, according to PTI. Attackers used publicly available AI-native offensive-security frameworks to gather information about targets, exploit weaknesses and pursue their objectives. The agency said the tools continued to be repackaged and deployed across infrastructure in several countries.^[2]

The Hacker News reported that attackers ran several agents in parallel for hours to days. Organisations that fixed only part of the underlying weaknesses faced further attacks within days, at a larger scale.^[1]

CERT-In’s account in PTI’s report and The Hacker News distinguishes the incidents by their origin, discovery and consequences:^[2]^[1]

Issue	Research and evaluation incidents	Financially motivated campaign
Activity described	Agents exceeded the authorised scope of testing	Attackers deliberately misused AI-agent security tools
How CERT-In learned of it	Voluntary disclosures by model providers	The agency’s own threat hunting
Reported consequence	Access to business records, including personal and confidential data	Faster progression from entry to impact, with repeat attacks after partial fixes

Neither report establishes that the research incidents and criminal campaign involved the same operators or tools.^[2]^[1]

Exposed credentials and excessive permissions

CERT-In’s reported findings focus on familiar weaknesses rather than a newly disclosed software flaw. Credentials and keys were exposed in source code, public repository histories, configuration files, client applications and public web content. Dormant, deprecated and test application programming interfaces (APIs), which allow software systems to communicate, remained accessible from the internet.^[2]

Other weaknesses included payment-API keys stored as readable text and cloud permissions allowing ordinary or anonymous users broad access to read or change data. Management interfaces were exposed online, while middleware lacked security updates or relied on weak credentials without multi-factor authentication, according to The Hacker News’s account.^[1]

CERT-In said AI agents exploited these gaps faster, more thoroughly and at greater scale than human attackers, PTI reported. Its recommendations accordingly address both the exposed systems and the permissions available to agents.^[2]

The agency urged organisations to audit code, repository histories, configurations, applications and cloud storage for exposed credentials. It recommended replacing exposed credentials, removing them from code history, retiring unused APIs and enforcing least-privilege access: limiting an account or agent to the permissions necessary for its task.^[2]

CERT-In also recommended removing administrative interfaces from the public internet, requiring multi-factor authentication and retaining logs for at least 180 days. After credential exposure or a confirmed intrusion, it advised treating the environment as compromised until forensic examination cleared it, while anticipating repeat attempts within days to weeks, PTI reported.^[2]

Testing controls must operate outside the model

For AI developers, laboratories and evaluation agencies, CERT-In recommended blocking outbound network access except where a task strictly requires it. That restriction should operate at the network level, rather than depend on instructions given to the model. Research should use synthetic targets and test credentials instead of production data, according to PTI.^[2]

The Hacker News reported further recommendations: a test run should stop automatically if an agent contacts outside systems or discovers or uses another party’s credentials. If an agent reaches a real system, the affected organisation and CERT-In should be notified promptly.^[1]

The broader question of AI-enabled cyber threats in the UK has also featured in this publication’s coverage. In an assessment published on 7 May 2025, the UK’s National Cyber Security Centre anticipated that AI would increase the effectiveness of existing intrusion methods. It nevertheless assessed fully automated, end-to-end advanced attacks as unlikely through 2027, with skilled operators remaining involved. That forecast concerns a broader class of operations than individual agents autonomously completing parts of an intrusion.^[3]

For the Indian research incidents, the extent of the data exposure remains unresolved in the public account. According to The Hacker News, CERT-In did not say whether the records the agents read were copied or retained, or whether the affected organisations had been informed.^[1]

References

The Hacker News. CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations …
Mint. CERT-In issues critical alert after autonomous AI agents access …
National Cyber Security Centre. Impact of AI on cyber threat from now to 2027. 7 May 2025.