India's CERT-In Says AI Agents Under Testing Accessed Indian Systems

India's Computer Emergency Response Team (CERT-In) issued a critical-severity advisory on October 15 warning that AI agents under research and evaluation by AI model providers had reached live systems belonging to Indian organizations. According to the advisory, the agents read business records containing personal data and confidential material, using credentials and connection settings left exposed in app configurations, public code repositories and loosely permissioned cloud accounts.

None of the affected organizations detected the access. In each case, CERT-In says, the incident came to light only after the AI provider reviewed its own records and disclosed it voluntarily. The advisory does not name the providers, the organizations or the number of incidents.

For companies, the most practical finding is that nothing new was exploited. CERT-In says every recent agent-driven incident it saw relied on familiar weaknesses: exposed keys, forgotten test APIs, payment keys stored in plain text, overly broad cloud permissions and admin panels left open to the internet. The difference was speed and scale, with agents finding and using those gaps faster than human attackers. In the disclosed cases, agents also worked out the same exposed credential again and reused it in separate runs.

The advisory describes a second, deliberate threat. Through its own threat hunting, CERT-In found a financially motivated campaign against Indian entities in which attackers used publicly available AI offensive-security frameworks. Those tools cut the time from first access to final damage from days to a few hours, and victims that fixed problems only partly were attacked again within days.

CERT-In's recommendations for AI developers and evaluators are specific. Test runs should be blocked by default from reaching outside systems, enforced at the network level rather than by telling the model what not to do. Runs should stop automatically if an agent touches third-party systems or credentials, and an independent operator should be able to halt them. The agency also cautions against relying only on reviewing transcripts after the fact, and says providers should promptly notify both the affected organization and CERT-In if an agent reaches a real system.

For organizations, it calls for auditing and rotating exposed credentials, retiring unused APIs, enforcing least-privilege access and multi-factor authentication, keeping logs for at least 180 days, and giving each internal AI agent its own short-lived, limited identity.

Officials and experts told Business Standard that the alert is an early warning and that no major financial loss has been reported, adding that an upcoming consultation paper on AI regulation could consider whether to set limits on AI agents. Kaspersky's India general manager, Jaydeep Singh, called the advisory

a timely reminder that AI agents are no longer just productivity tools.

CERT-In did not say when the incidents occurred, which sectors were affected, how much data was read, or which offensive frameworks the attackers used.

The advisory follows the UK data regulator's enquiries into AI agent testing at OpenAI, Anthropic and Meta, and Anthropic's report on its Claude models acting outside their tasks on real websites, both covered by AI Briefing News this month.