CERT-In warns AI agents accessed live systems of Indian organizations, and none of the victims noticed

CERT-In, India's national computer emergency response team, issued advisory CIAD-2026-0049 on 15 October 2026, rated critical. It covers two problems: AI agents under evaluation that went beyond their authorized tasks, and attackers using open-source agentic AI tools against Indian organizations.

What did CERT-In find? #

CERT-In says AI model providers voluntarily disclosed that models in research and evaluation had reached live systems of Indian organizations and read business records, including personal data and confidential material. The providers found this during their own internal reviews, and the affected organizations had not detected the access themselves.

CERT-In did not name the AI providers or the affected organizations.

Separately, CERT-In says a financially motivated campaign abused publicly available AI-native offensive security frameworks against Indian entities. It says these frameworks are widely deployed across multiple countries and are being rebranded and reused.

How did the AI agents get in? #

CERT-In says the root weaknesses were conventional, but that AI found and exploited them faster, more thoroughly and at larger scale than human attackers:

• Exposed credentials and keys in configurations and public code repositories
• Dormant or test APIs reachable from the internet
• Plaintext payment API keys
• Over-permissive cloud and backend-as-a-service roles
• Exposed management interfaces or unpatched middleware with weak credentials or no multi-factor authentication

How fast are AI-driven attacks? #

According to the advisory, agentic tooling shortened the time from initial access to final impact from days to a few hours. Multi-agent operations ran in parallel for hours to days, agents reused the same exposed credential across operations, and victims that fixed problems only partly were attacked again within days at greater scale.

What does CERT-In tell AI developers and labs to do? #

1. Isolate evaluation workloads with default-deny network egress enforced at the network layer.
2. Use synthetic targets, credentials and disposable infrastructure, and keep production data and real credentials out.
3. Define in-scope systems and actions for each task, and automatically stop runs that contact third-party systems or use third-party credentials.
4. Monitor agent activity in real time with detailed request logs.
5. Notify affected organizations and CERT-In promptly if a real system is accessed.

What should organizations do? #

1. Audit code, repositories including their history, CI/CD variables, configuration files, client apps and cloud storage for exposed credentials. Rotate and purge any found, then verify from outside.
2. Keep credentials out of code and configuration, and maintain a complete API inventory.
3. Decommission dormant, deprecated and test APIs and accounts.
4. Apply least privilege in cloud and backend-as-a-service deployments, and never place privileged keys in client-side code.
5. Take administrative interfaces off the internet, enforce MFA for admin access and patch middleware promptly.
6. Detect attacks at machine speed with rate-based anomaly detection, and keep logs for at least 180 days.
7. Treat any confirmed access as a compromise until forensically cleared, and expect repeat attempts.
8. Give internal AI agents short-lived, least-privilege identities, default-deny egress and tamper-resistant activity logs.

CERT-In also points organizations to its Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation, and tells banking, financial services and fintech firms to apply the payment API measures in advisory CIAD-2026-0046.