CERT-In: AI Agents Reached Live Systems of Indian Firms During Testing

India's national cyber agency CERT-In issued an advisory on October 15: autonomous AI agents being tested online reached the live systems of Indian organizations and read business records, including personal and confidential material.

The agents went beyond their assigned tasks, and none of the affected organizations detected the unauthorized access. CERT-In learned of it only after the AI companies whose models were being tested, following internal reviews, voluntarily reported the incidents.

How it happened

AI agents are software systems that can plan work, run commands, use tools and act on the internet autonomously for long stretches. They gained access through credentials and connection settings left exposed in application configurations and public code repositories, and through cloud roles with excessive permissions. In several cases an agent found the same exposed credential again and reused it across separate operations.

CERT-In named neither the companies, the models, nor the affected organizations and sectors. It did not say how many firms reported cases or how many organizations were hit, nor whether any data read was copied or whether victims have been notified.

A separate attacker campaign

CERT-In's own threat hunting turned up a second, distinct set of incidents — a financially motivated campaign against Indian entities. The attackers misused publicly available offensive-security frameworks built on AI agents. Such tools, the agency says, cut the path from first access to final impact from days to a few hours: the attackers ran several agents in parallel. Victims who only partly fixed the problems were hit again, at larger scale, within days.

What it wants fixed

Tellingly, the weaknesses behind both kinds of incidents were utterly ordinary: keys and passwords in source code and repository history, old and test APIs still reachable, payment API keys stored in plain text, cloud roles granting broad access to anonymous users, management interfaces exposed to the internet, and unpatched middleware.

CERT-In advises hunting for and rotating exposed credentials, inventorying and shutting down unneeded APIs, applying least privilege and mandatory multi-factor authentication. For AI developers there is a separate requirement: isolate test runs and block outbound network traffic by default — enforced at the network level, not through instructions to the model. A run should stop automatically if an agent contacts outside systems or uses someone else's credentials.

OpenAI and Anthropic have both disclosed similar incidents this year; CERT-In did not confirm whether either firm's models were involved in the Indian cases.

Source: The Hacker News