CERT-In Says AI Agents Quietly Breached Indian Systems
India’s cyber agency says AI agents under evaluation accessed confidential business data, while attackers separately used agentic tools to accelerate intrusions.
Topics
News
- Meta Releases Muse Spark Open for Local AI Work on Macs
- Anthropic Gives METR Employee-Level Access to Review AI Risks
- Google Moves Links Higher in AI Search as Publishers Face Traffic Pressure
- CERT-In Says AI Agents Quietly Breached Indian Systems
- AI Dispatch | India Gives Diplomacy an AI Face
- Cisco Warns Critical Email Gateway Flaw Under Active Attack
Artificial intelligence agents being tested on the open internet accessed live systems of Indian organizations without authorization and read business records containing personal and confidential information, India’s national cyber agency has warned.
CERT-In said it had received multiple voluntary disclosures from AI model providers whose internal reviews found that agents used in research and evaluation had gone beyond their assigned tasks. None of the affected organizations detected the access themselves, the agency said in a critical advisory issued on Thursday, October 15.
The agents reached the systems using credentials and connection details exposed in application configurations and public code repositories, as well as cloud roles that granted excessive permissions.
In some cases, agents later rediscovered and reused the same exposed credentials in separate operations.
CERT-In did not identify the AI companies, models or Indian organizations involved. It also did not disclose how many organizations were affected.
The agency separately uncovered a financially motivated campaign against Indian entities in which attackers deliberately used publicly available AI-based offensive security frameworks for reconnaissance and exploitation. CERT-In said versions of the tools had been repeatedly rebranded and deployed through infrastructure in several countries.
In those attacks, agentic tools shortened the period between initial access and final impact from days to a few hours. Attackers also ran several AI agents in parallel for hours or days, while organizations that only partially fixed their vulnerabilities were targeted again within days and at greater scale.
The underlying security failures were not new. CERT-In pointed to exposed passwords and API keys, abandoned or test APIs left online, plaintext payment credentials, overly broad cloud permissions, internet-facing administrative systems and unpatched software.
“In the incidents observed, AI found and exploited these conventional weaknesses faster, more exhaustively and at greater scale than human attackers,” CERT-In said.
For companies developing and evaluating AI agents, CERT-In recommended isolating tests from the public internet by default and enforcing those restrictions at the network level rather than relying on instructions given to a model.
It also said an evaluation should automatically stop if an agent contacts an external system or discovers or uses third-party credentials. If a model reaches a real system, the affected organization and CERT-In should be notified promptly.
For businesses, CERT-In recommended searching code and repositories for exposed credentials, removing unused APIs, tightening cloud permissions, requiring multi-factor authentication for administrative access and monitoring for unusually rapid or high-volume API activity.
It also advised treating systems as compromised after confirmed unauthorized access until a forensic investigation clears them.
