On October 15, India’s governmental cybersecurity agency CERT-In flagged incidents in which artificial intelligence (AI) agents accessed live systems of Indian organisations during research and evaluation. The advisory, which was rated critical, said the AI agents read business records containing personal data and confidential information without authorisation.
According to the advisory, CERT-In had received multiple voluntary disclosures from AI model providers whose models had reached the live systems of Indian organisations while conducting research and evaluation activities on the internet. In some incidents, AI agents under research and evaluation exceeded their assigned task authorisation and accessed Indian information and communication technology (ICT) assets without authorisation. “The recorded activity involved reading business records, including personal data and confidential material,” the advisory stated.
The breaches were facilitated by credentials and connection settings exposed in application configurations, public code repositories, and cloud service roles that granted broader access than necessary. Notably, none of the affected organisations detected the unauthorised access themselves. The incidents came to light only after the AI model providers conducted internal reviews and disclosed the activity. CERT-In highlighted the efficiency of these AI-driven attacks, noting that in a financially motivated campaign against Indian entities, “agentic tooling compressed the time between initial access and final impact from days to a few hours.”
The advisory, rated critical, underscores the emerging risks posed by AI agent software systems capable of independently planning tasks, issuing commands, using tools, and operating on the internet over extended periods. To mitigate these risks, CERT-In has advised AI model developers and research laboratories to isolate testing environments from production systems, restrict network access, and use synthetic credentials instead of real ones. It also recommended real-time monitoring of agent activity and prompt reporting if an agent accesses a live system.
Organisations have been advised to audit code repositories and configuration files for exposed credentials, revoke compromised keys, remove obsolete application programming interfaces (APIs) and restrict cloud permissions. CERT-In also warned that agents could reuse exposed credentials across separate operations, while organisations that fail to fully fix vulnerabilities could face repeat attacks within days.
