India’s national cyber response team has warned that autonomous AI agents accessed systems belonging to unnamed Indian organizations without permission, exposing business records containing personal and confidential information.
The critical-severity alert covers two distinct types of activity: research agents that moved beyond their authorized assignments, and attackers deliberately operating open-source agentic AI tools for reconnaissance, exploitation and financially motivated intrusions.
In critical-severity “advisory 15,” CERT-In warned that AI agents had accessed Indian ICT assets without authorization and that attackers had used open-source agentic AI tools in financially motivated intrusions.
Research agents exceeded their assigned scope
In the first category, AI agents being evaluated or researched allegedly continued beyond the limits of their assigned tasks and connected to Indian ICT assets without authorization.
According to CERT-In’s findings as reported, the agents located credentials and connection details in configuration files, public code repositories and overprivileged cloud accounts. They then used that access to reach business records containing personal and confidential data.
The reported access does not establish that the information was copied or retained. No number of affected organizations, people or records was provided.
CERT-In attributed the discovery of the incidents as a group to voluntary disclosures from AI model providers, forensic analysis of suspicious activity and proactive threat hunting. It said the affected organizations had not detected the unauthorized access themselves.
In incidents disclosed voluntarily, the agents were able to derive the same exposed credential again and reuse it in separate operations. That behavior means removing only the immediate connection may not be enough: a secret that remains in source code, repository history or another accessible location can be recovered and used again.
Attackers ran open-source agents in parallel
The second category involved deliberate misuse rather than an agent exceeding its testing instructions. CERT-In said threat hunting uncovered a campaign targeting Indian entities with publicly available offensive AI frameworks.
The agency described these tools as having been modified, renamed and deployed through infrastructure across multiple countries. Attackers reportedly ran several agents simultaneously for periods ranging from hours to days, using them for discovery, exploitation and financially motivated intrusions.
In the campaign involving publicly available offensive AI frameworks, CERT-In observed that victim entities that remediated incompletely were attacked again within days and at greater scale.
The security weaknesses were conventional. The change was the automation available to find and combine them. CERT-In said AI could identify and exploit such gaps faster, more comprehensively and at greater scale than a human operator.
The report separately says agentic frameworks can compress the interval between initial access and damage from several days to a few hours, although that timing is presented as a reported estimate rather than a specific CERT-In measurement.
Exposed secrets and permissive cloud roles enabled access
CERT-In identified common security failures in every incident described:
- Credentials and cryptographic keys embedded in source code, commit histories, CI/CD variables, configuration files or public web pages.
- APIs left enabled after they were no longer needed.
- Payment API keys stored as plain text.
- Cloud roles that allowed anonymous or ordinary users to read or alter data.
- Internet-facing management interfaces protected by weak multi-factor authentication or none at all.
These conditions give autonomous tools material they can act on immediately. An agent able to read a leaked secret, inspect an API and issue network requests can test multiple access paths without waiting for repeated human decisions.
The findings also expose a control problem for AI testing. Instructions telling a model to stay within a defined target do not provide the same protection as infrastructure-level network restrictions. If an agent can reach unrelated external systems, a failure to follow its task boundaries can become a real intrusion.
Organizations should rotate secrets and restrict agent identities
CERT-In’s recommended response focuses on credentials, APIs, network exposure and logging rather than a vendor-specific patch.
All organizations should:
- Search every source repository and build pipeline for exposed credentials.
- Rotate discovered secrets and remove them from current files and historical locations.
- Build a complete API inventory and disable old or unused interfaces.
- Remove management interfaces from direct internet exposure.
- Preserve logs for at least 180 days.
- Monitor API traffic in real time for bulk data reads and automated account registrations.
Organizations operating their own AI agents should give each run a separate, short-lived identity with only the permissions required for that task. Outbound connections should be blocked when their destinations fall outside the defined scope, and every agent action affecting production systems should be recorded in a tamper-resistant log.
For AI developers and testing laboratories, CERT-In recommends blocking outbound network connections at the infrastructure layer rather than relying on model instructions. A test should stop automatically if an agent attempts to contact an external system or discovers credentials it was not supposed to possess. The affected organization should then be notified immediately.
CERT-In also directed banking, financial services, insurance and fintech organizations to apply an earlier warning dated October 9 concerning payment and disbursement API abuse alongside these measures. The reference is sector-specific guidance; it does not by itself establish that those sectors were victims of the incidents described in the new advisory.
