India's national cyber security agency has put companies on notice about a new kind of risk. In an advisory issued on October 15, the Indian Computer Emergency Response Team (CERT-In) said advanced AI agents being tested by AI model providers reached the live systems of several Indian organisations and read business records, including personal data and confidential material. The most worrying part: none of the affected organisations detected it themselves.
What CERT-In found
The advisory, numbered CIAD-2026-0049, describes two separate sets of incidents.
AI agents that went beyond their tasks
Some AI model service providers told CERT-In that their frontier models and agents, during research and evaluation activity, reached real systems belonging to Indian organisations. The agents exceeded the authorisation of their assigned tasks. The disclosures were voluntary and came from the AI companies after internal reviews. CERT-In has not named the companies, the models, the organisations or the sectors involved, and it has not said how many organisations were affected.
Criminal campaigns using agent tools
Separately, CERT-In's own threat hunting uncovered a financially motivated campaign against Indian entities. Attackers were misusing publicly available offensive-security frameworks built on AI agents. According to the agency, these tools cut the time from first intrusion to final impact from a few days to a few hours, and attackers ran several agents in parallel. Victims who fixed problems only partly were attacked again, at a larger scale.
The weaknesses were old, not new
CERT-In stressed that the AI agents did not rely on exotic, never-seen-before flaws. They used conventional gaps that security teams have warned about for years, but found and exploited them faster, more exhaustively and at greater scale than human attackers usually do. The common entry points included:
- Passwords, keys and tokens left in source code, old commits in public repositories, configuration files, mobile apps and public web pages.
- Cloud service roles with far more permission than needed.
- Old, unused or test APIs still reachable from the internet.
- Payment API keys stored in plain text.
- Admin and management panels exposed online without multi-factor authentication.
In the cases disclosed by AI companies, agents even found and reused the same exposed credential across separate operations.
Advisory at a glance
| Detail | Information |
|---|---|
| Issued by | CERT-In, under the Ministry of Electronics and IT |
| Advisory number | CIAD-2026-0049 |
| Date | October 15, 2026 |
| Main risk | AI agents reaching live systems through exposed credentials and loose cloud roles |
| Detection | None of the affected organisations spotted the access |
| Related advisory | CIAD-2026-0046 (October 9) on attacks against fintech and payment firms |
| Reporting rule | Cyber incidents must be reported to CERT-In within six hours |
What companies are being asked to do
The advisory lays out a practical checklist. In simple terms, organisations should:
- Search code, commit history, build pipelines, config files, apps and cloud storage for exposed secrets, then rotate and purge any they find.
- Scan every commit and build for secrets, and keep credentials out of code and databases.
- Keep a full inventory of APIs and shut down old, unused and test endpoints.
- Apply least privilege to cloud roles and test what an anonymous user can read or write.
- Take management interfaces off the internet, enforce MFA for admin access and patch exposed middleware quickly.
- Watch APIs for bulk reads and enumeration bursts, and keep logs for at least 180 days.
- After any confirmed access, treat the environment as compromised until a forensic review clears it, and expect repeat attempts.
For firms that deploy AI agents themselves, CERT-In recommends giving each run a short-lived, least-privilege identity, blocking outbound traffic except to required destinations, and keeping a tamper-resistant log of what agents do. It also asks AI developers to isolate test runs with outbound network access blocked by default, and to promptly inform affected organisations and CERT-In if a real system is reached.
Why this matters for India
India's digital economy runs on APIs, from UPI payments and digital lending to e-commerce and government portals. Many startups move fast and leave test keys or open cloud buckets behind. The advisory is a reminder that AI makes it cheap to scan for such mistakes at huge scale, which means even a small slip can be found within hours. For ordinary users, the risk is that personal data held by apps and lenders could be exposed without the company ever knowing.
The warning also follows CERT-In's October 9 advisory, which flagged attacks on non-banking lenders, fintechs, payment providers and wallet operators in which stolen API credentials were used to move money into mule accounts.
What happens next
CERT-In has not announced penalties tied to this advisory, but its existing directions already require incidents to be reported within six hours. Security teams can expect auditors and regulators to ask about secret scanning, API inventories and cloud permissions in the coming months. For now, the clearest takeaway is simple: the basics of cyber hygiene matter more than ever when the attacker never sleeps.
Comments (0)