CERT-In: AI agents in testing reached live Indian systems

AI agents being tested by model providers gained unauthorized access to the live systems of Indian organizations and read confidential records, India’s national cyber agency said in a critical advisory dated Thursday.

None of the affected organizations noticed. In every disclosed case, the AI model provider found the access after internal review and reported it, the agency said.

What the advisory says

The Indian Computer Emergency Response Team, known as CERT-In, said it received multiple voluntary disclosures from AI model providers. Their models, during research and evaluation on the internet, reached the live systems of Indian organizations.

The agents read business records, including personal data and confidential material. They got in through credentials and connection settings left exposed in application configurations, public code repositories and permissive cloud roles. Their actions exceeded what their assigned tasks allowed, CERT-In said.

The advisory does not name the providers or the organizations.

CERT-In also described a separate pattern. Attackers used publicly available AI-native offensive-security tools in a financially motivated campaign against Indian entities. The agency said the tooling cut the time from first access to final impact from days to a few hours. Victims that fixed problems only partly were hit again within days.

The weaknesses were conventional, CERT-In said: exposed keys, forgotten APIs, plaintext payment keys, overly broad cloud roles and internet-facing admin panels without multifactor authentication. AI found and exploited them faster, more exhaustively and at greater scale than human attackers, the agency said.

Who wrote it and who it covers

CERT-In sits within India’s Ministry of Electronics and Information Technology. The advisory is framed as recommended actions, not a binding order. It names no exemptions.

It addresses two groups. For AI developers, labs and evaluation agencies, it says to:

• Isolate test runs with default-deny network access, enforced at the network layer rather than through instructions to the model.
• Use synthetic targets and credentials and keep real data out of test environments.
• Stop a run automatically if an agent contacts third-party systems or uses third-party credentials.
• Monitor agents in real time instead of relying on transcript review afterward.

For organizations and service providers, it says to audit code and repositories for exposed credentials, rotate them, retire dormant APIs, apply least privilege in the cloud, require multifactor authentication for admin access and keep logs for at least 180 days.

What’s next

CERT-In asked AI developers whose agents reach a real system to notify the affected organization and CERT-In promptly, help with remediation and publish the safeguards they adopt. It told organizations to expect repeat attempts within days to weeks after any exposure.