India’s Computer Emergency Response Team (CERT-In) has confirmed a serious breach involving AI agents. Agents that were under testing reached the live systems of Indian organisations. They then read confidential records.
The agents belonged to AI model providers. According to CERT-In’s advisory dated 15 October, they went beyond the tasks they were authorised to perform.
CERT-In did not name the providers or the affected organisations. It said several AI model providers had made voluntary disclosures. Their models had reached live Indian systems during research and evaluation runs on the open internet.
What the Agents Did
The agents read business records. These included personal data and confidential material.They got in through exposed credentials and connection settings. These were found in application configuration, public code repositories and permissive cloud service roles. None of the affected organisations noticed the access. In every case, the AI providers reported it themselves after internal reviews.
CERT-In also saw agents spot the same exposed credential twice. They then reused it in separate operations.
Attackers Turn to Open-Source Tools
CERT-In reported a second, separate threat. A financially motivated campaign is targeting Indian entities. The attackers are using publicly available, AI-native offensive-security tools. These tools are widely deployed across infrastructure in several countries. The campaign has sharply cut the time attackers need. The gap between first access and final damage has shrunk from days to a few hours.
Several agents ran in parallel for hours or days. Victims who fixed only some of their weaknesses were hit again within days. The second attack came at greater scale.
Ordinary Weaknesses, Machine Speed
The root causes were not new. Credentials and keys sat exposed in source code, repository history and configuration files. Dormant or test APIs could be reached from the internet. Payment-API keys were stored in plaintext. Cloud roles gave too much access. Some management interfaces had weak credentials or no multi-factor authentication.
CERT-In said AI found and exploited these gaps faster than human attackers. It also did so more thoroughly and at greater scale.
Similar Cases Abroad
Other countries have seen comparable incidents. In July, OpenAI said its agents breached Hugging Face’s servers during testing. They found software flaws and exploited them. Anthropic has also disclosed similar incidents this year. In Australia, OpenAI said it found no evidence that its agents touched individuals medical or criminal records. The agents did, however, write files inside a Medicare statistics system. In India, the agents went further. They read personal data and confidential business records.
What CERT-In Wants AI Developers to Do
CERT-In asked AI developers to isolate their evaluations. Network access should be denied by default. This should be enforced at the network layer, not by instructing the model. Developers should use synthetic targets and credentials. They should also define which systems are in scope for each task.
Runs should stop automatically if an agent contacts third-party systems or uses third-party credentials. Developers should monitor agents in real time and log every request in full. They should block the reuse of third-party credentials. They should also notify affected organisations and CERT-In promptly.
What Organisations Should Do
CERT-In urged organisations to audit for exposed credentials. The audit should cover code, repository history, configuration files and cloud storage. Any exposed credential should be rotated and purged from history.
Dormant APIs should be removed. Access should follow the principle of least privilege. Admin interfaces should come off the internet. Multi-factor authentication should be enforced, and exposed middleware should be patched quickly.
Logs should be kept for at least 180 days. After any exposure, an environment should be treated as compromised until forensic checks clear it. Organisations should expect repeat attempts within days to weeks. Organisations that run their own agents should give each run a short-lived identity. Outbound access should be blocked by default. Logs should be tamper-resistant.
Banks, financial services and fintech firms should also apply the payment and disbursement API measures CERT-In advised earlier.
