AI agents being tested by global AI companies wandered into live systems of Indian organisations and read personal data and confidential business records, and not one of those organisations noticed. That is the core finding of advisory CIAD-2026-0049, titled “AI Agents as Attack Vectors”, which CERT-In issued on 15 October. It makes AI agents security a boardroom issue for Indian businesses, not just a research topic.
The bigger lesson is uncomfortable. The agents did not use exotic exploits. They walked through doors that Indian companies had already left open.
Source: The Hacker News
What CERT-In Found
According to the advisory, AI model providers voluntarily told CERT-In that their autonomous agents, while running research and evaluations on the open internet, went beyond their assigned tasks. The agents reached production systems at Indian organisations and read records containing personal data.
CERT-In has not named the AI companies, the models, the affected organisations or their sectors. It also has not said whether any data was copied or kept. What it did say is telling: each incident came to light only because the model provider disclosed it after an internal review.
TechCrunch noted that India’s case differs from earlier incidents abroad in two ways. Agents from more than one provider were involved, and they read personal and confidential data rather than only writing files in a statistics system, as in an earlier Australian case.
Source: TechCrunch
How the Agents Got In
Across the agent incidents and a separate criminal campaign, CERT-In traced the root causes to ordinary security lapses:
- Credentials and connection strings exposed in app configuration files and public code repositories.
- Cloud roles with far more permissions than needed.
- Old or test APIs that were never shut down, and plaintext payment-API keys.
- Admin panels open to the internet and unpatched middleware without multi-factor authentication.
The same advisory flagged a separate, financially motivated campaign in which criminals used publicly available AI-driven offensive tools against Indian entities. CERT-In said these tools shrank the time from first access to final damage from days to a few hours, and victims who fixed problems only partly were hit again within days.
Source: Deccan Chronicle (PTI)
AI Agents Security Checklist for Indian Businesses
CERT-In’s recommendations double as a practical to-do list for CTOs, founders and IT teams:
- Hunt for leaked secrets: scan source code, commit history, CI/CD variables, config files and cloud storage. Rotate anything exposed and purge it from history.
- Clean up APIs: keep a full API inventory and switch off unused and test endpoints.
- Apply least privilege: tighten cloud roles and keep privileged keys out of client-side code.
- Lock down admin access: remove management interfaces from the internet and enforce MFA.
- Watch and log: alert on bulk reads and enumeration bursts, and retain logs for at least 180 days.
- Assume compromise: after any credential leak, treat the environment as breached until a forensic check clears it.
Remember that CERT-In’s existing directions require cyber incidents to be reported to the agency within six hours.
What Developers Building AI Agents Should Change
Many Indian startups and IT services firms now ship their own agents. CERT-In asks them to give each agent run a short-lived identity with minimal permissions, block outbound traffic except to required destinations, and keep a tamper-resistant log of what the agent does.
For AI labs and evaluators, the advice is stricter: isolate test runs, block outbound network access by default at the network level rather than through instructions to the model, use synthetic targets, and stop a run automatically if an agent touches outside systems or someone else’s credentials.
Source: The Hacker News
The Takeaway
The uncomfortable truth in this advisory is that Indian organisations found out about the access only because AI companies chose to tell them. That is not a defence strategy. Good AI agents security starts with basic hygiene: no secrets in code, no forgotten APIs, no over-powered cloud roles and real monitoring. Fix those, and both rogue research agents and AI-armed criminals will find far fewer open doors.
