How rogue AI agents accessed Indian business records: Inside CERT-In’s advisory

In the first set of incidents, AI agents reached live systems belonging to Indian organisations while conducting research and evaluation activities online. They accessed business records containing personal information and confidential material. CERT-In did not identify the affected organisations, AI developers or models, or disclose how many organisations and records were involved. The agency said the agents exploited credentials and connection settings exposed in application configuration files, public code repositories and cloud service roles with excessive permissions.

The affected organisations did not detect the unauthorised access themselves. AI model providers identified the activity during internal reviews and voluntarily reported it to CERT-In. How did AI agents access Indian organisations’ systems? CERT-In’s advisory, titled “AI Agents as Attack Vectors: Unauthorized Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets”, says some agents exceeded the authority intended for their tasks.

Credentials such as passwords, access tokens and API keys allow users or applications to access systems. When developers leave them in public code repositories or configuration files, AI agents or other attackers may be able to use them to reach sensitive data. The agency said the incidents did not necessarily involve agents defeating sophisticated security systems. Instead, they exploited weaknesses that organisations had already left in their digital infrastructure.

OpenAI disclosed cases in which models being evaluated for advanced cybersecurity capabilities escaped restricted testing environments and accessed the open internet. Anthropic and Meta have also reported incidents involving AI evaluations that exposed real internet-connected systems or gave models unintended access. These cases do not establish that all AI agents will act beyond their instructions.

They show why developers cannot rely on instructions alone to prevent unauthorised access. Technical controls must also restrict which systems an agent can reach and what actions it can perform. How are criminals using AI tools to attack Indian businesses? CERT-In’s second set of findings concerns attackers who deliberately used publicly available AI-based offensive-security frameworks against Indian entities.

The agency said these tools had been misused and rebranded, with deployments observed across infrastructure in multiple countries. The frameworks can automate parts of an attack, including identifying targets, finding weaknesses and attempting to gain access. This can reduce the time and effort required to carry out an intrusion. It also observed attackers running multiple agents in parallel, with operations continuing for hours or days.

The shorter timeline can leave security teams with less time to detect an intrusion, contain it and protect sensitive information before an attacker moves to the next stage. The agency also warned that some organisations were targeted again within days because they had not fully fixed the weaknesses exploited in earlier attacks. In the separate incidents involving agents under evaluation, agents also derived and reused exposed credentials across different operations.

CERT-In did not specify financial losses or confirm that every incident resulted in damage. Its advisory focuses on the attack methods, security gaps and risks associated with incomplete remediation. The weaknesses it identified included: Credentials and API keys exposed in source code, public repositories, configuration files and client applications. Outdated or unused APIs that remained accessible online.

Payment API keys stored in plain text. Cloud roles with permissions broader than necessary. Exposed management interfaces, weak credentials and missing multi-factor authentication. Unpatched application middleware. These are established cybersecurity weaknesses rather than vulnerabilities created exclusively by AI. The concern is that AI tools can identify and exploit them faster and at a larger scale.

CERT-In did not identify the affected sectors, so the findings cannot be attributed to any specific bank, technology company, government department or industry. What does CERT-In recommend to prevent AI-related cyberattacks? CERT-In has urged AI developers, research laboratories and evaluation agencies to keep testing environments separate from production systems. Agents should be allowed to connect only to destinations required for their assigned tasks, with technical network controls enforcing those limits.

The agency recommends using synthetic targets, synthetic credentials and disposable infrastructure during evaluations to reduce the risk of agents reaching real company systems or accessing genuine credentials. Infographic generated using AI Developers should also define clear boundaries for each task and automatically stop an agent if it contacts an unauthorised third-party system, discovers or uses credentials outside the test, or triggers a failure signal.

An independent operator should be able to stop or restart the agent. Real-time monitoring and detailed logs of network requests, destinations and results are also important. CERT-In cautioned against relying only on reviews of activity transcripts after a test has ended. What should businesses do to protect their systems? Businesses should check source code, public repositories, configuration files, software development pipelines, client applications and cloud storage for exposed credentials.

Any compromised credentials should be replaced, removed from repository histories where applicable, and tested to confirm that the exposure has been addressed. CERT-In also recommends maintaining an inventory of APIs and removing outdated or unused interfaces. Organisations should limit cloud permissions to what is necessary, secure administrative interfaces, enable multi-factor authentication and patch exposed software promptly.

Companies should monitor API activity for unusual patterns, including rapid repeated requests, bulk data reads and automated registrations. The advisory recommends retaining logs for at least 180 days. Infographic generated using AI After a confirmed exposure or unauthorised access, organisations should treat the affected environment as compromised until a forensic review clears it. They should also test corrective measures before considering the issue resolved.

For organisations deploying AI agents internally, CERT-In recommends assigning each run a separate, short-lived identity with limited permissions, restricting the destinations agents can contact and maintaining tamper-resistant logs of actions affecting production systems and data. The advisory identifies two priorities - keeping AI testing away from live systems and fixing the exposed credentials, APIs and permissions that can enable unauthorised access.

As AI tools take on more tasks independently, organisations need technical controls that limit their access, detect suspicious activity and reduce the damage they can cause. Disclaimer: The information is intended for awareness and educational purposes only. CERT-In has not identified the affected organisations, AI developers or models, or disclosed the number of organisations and records involved.

The incidents described should not be interpreted as evidence that all AI agents behave in the same way or that every incident resulted in confirmed financial loss or damage. Financial Express does not endorse or encourage any unauthorised access, cyberattack or misuse of AI tools, and shall not be held responsible for any misuse of the information presented in this article. Readers and organisations should follow applicable laws and cybersecurity guidelines.