CERT-In: AI Agents Accessed Indian Firms’ Live Systems

AI agents being tested by their own developers went beyond their assigned tasks and got into live systems at several Indian organisations, reading business records that included personal data and confidential material.

The Indian Computer Emergency Response Team (CERT-In) disclosed this in a critical-severity advisory issued on 15 October 2026. None of the affected organisations noticed. Every case surfaced only after the AI model providers reviewed their own activity and reported it to CERT-In.

The advisory, CIAD-2026-0049, treats AI agents as attackers in their own right. An AI agent is software that can plan work, run commands, call tools, and act on the internet for long stretches without a human directing each step.

According to CERT-In, multiple AI model providers voluntarily told the agency that their models had reached Indian organisations’ systems during research and evaluation work on the open internet. The agents got in using credentials and connection settings they found in exposed application configuration files, public code repositories, and overly permissive cloud service roles.

CERT-In said the models’ actions exceeded what their tasks authorised them to do. In the disclosed cases, the agents also reused the same exposed credentials across separate operations, so a single leaked key granted repeated access. The agency did not name the AI companies, the models, the affected organisations, or how many there were.

Criminals are using agentic tools against Indian targets.

The second category in the advisory came from CERT-In’s own threat hunting. The agency found a financially motivated campaign targeting Indian entities, built on publicly available AI-native offensive security frameworks. These are open-source toolkits that automate reconnaissance and exploitation, and CERT-In said they are being rebranded and run on infrastructure in multiple countries.

In this campaign, agentic tooling reduced the time from initial access to final impact from days to a few hours, with several agents working in parallel for hours or days. Victims who had only partly fixed their weaknesses were attacked again within days, on a larger scale.

Across both categories, the weaknesses were ordinary ones:

• keys exposed in source code and repository history
• dormant and test application programming interfaces (APIs) are still reachable online
• payment-API keys stored in plaintext
• cloud and backend-as-a-service roles that let anonymous callers read and write broadly
• Internet-facing admin panels with weak passwords or no multi-factor authentication

CERT-In said AI exploited these “faster, more exhaustively and at greater scale than human attackers.”

Jaydeep Singh, general manager for India at Kaspersky, said the advisory shows AI agents are “no longer just productivity tools.” In comments carried by PTI, Singh said agents given broad access move through gaps that already exist, such as misconfigured cloud services and excessive permissions.

He added that valid accounts, public-facing applications, and trusted relationships were the entry point for over 80% of the attacks Kaspersky investigated in 2025. He urged companies to inventory every agent, sandbox it, and require human approval before any irreversible action.

The advisory follows OpenAI’s 21 July 2026 disclosure that GPT-5.6 Sol and an unreleased model escaped an internal cyber evaluation that was running with reduced safeguards. Those models reached Hugging Face’s production systems while hunting for benchmark answers. CERT-In has not said whether any of the disclosures it received relate to that incident.

CERT-In’s instructions to AI labs and evaluation agencies are specific:

• Block all outbound network traffic except what a task strictly needs, and enforce that block at the network layer rather than through instructions to the model.
• Use synthetic targets and synthetic credentials.
• Stop a run automatically if an agent touches a third-party system or credential.
• Log agent activity in real time, because reviewing transcripts afterwards can miss actions that the model’s reasoning makes look legitimate.
• Notify both the affected organisation and CERT-In whenever an agent reaches a real system.

What organisations should do?

For organisations and service providers, CERT-In points to its Blueprint for defending against AI-assisted exploitation. It then asks them to:

• Audit source code, commit history, CI/CD variables, configuration files, client apps, and cloud storage for exposed secrets.
• Rotate and purge any secrets they find.
• Retire dormant and test APIs.
• Never ship privileged keys in client-side code.
• Test what an anonymous caller can read and write.
• Take admin interfaces offline and enforce multi-factor authentication.
• Alert on enumeration bursts and bulk reads, and keep logs for at least 180 days.
• After any credential exposure, treat the environment as compromised until it has been forensically cleared.

Companies running their own agents should give each run a short-lived, least-privileged identity and keep a tamper-resistant activity log. Banks and fintech firms are also advised to apply the payment API measures in the earlier advisory CIAD-2026-0046.

Several questions remain open. CERT-In has not said which sectors were hit, whether the data the agents read was retained, or whether people whose personal data was exposed have been told. CERT-In’s 2022 directions require organisations to report cyber incidents within six hours of becoming aware of them. In these cases, the organisations never noticed, and the reports exist only because AI developers chose to file them.