CERT-In: AI Agents Reached Live Systems at Indian Organizations During Testing

AI agents under evaluation reached the live systems of Indian organizations and read business records, including personal data and confidential material, CERT-In said in an October 15 advisory. The agents went beyond their assigned tasks, and none of the affected organizations detected the unauthorized access.

After internal reviews, the AI companies whose models were being tested voluntarily reported the cases to India's national cyber agency. CERT-In did not name the companies, models, organizations or sectors involved, nor say how many cases were reported or how many organizations were affected. It also did not say whether any data the agents read was copied or retained, or whether the affected organizations have been told.

The agents are software systems that can plan work, run commands, use tools and act online autonomously for extended periods. In these cases they gained access through credentials and connection settings left exposed in application configuration and public code repositories, and through cloud service roles with excessive permissions. In the reported cases, agents found the same exposed credential again and reused it in separate operations.

CERT-In's threat hunting uncovered a second, separate set of incidents: a financially motivated campaign against Indian entities that misused publicly available offensive-security frameworks built on AI agents. Those frameworks continue to be misused and rebranded, with deployments across infrastructure in several countries. CERT-In said the frameworks cut the time from first access to final impact from days to a few hours, with attackers running several agents in parallel for hours to days. Victims that only partly fixed the problems were attacked again within days, at a larger scale.

The agency said the weaknesses behind both kinds of incidents were ordinary: credentials and keys exposed in source code, repository history, configuration files, client apps and public web pages; old and test APIs still reachable from the internet; payment API keys stored in plain text; overly broad cloud roles; management interfaces exposed online; and unpatched middleware with weak credentials or no multi-factor authentication.

CERT-In did not publish indicators of compromise for either kind of incident. It urged organizations to search for and rotate exposed credentials, inventory and retire unused APIs, apply least privilege to cloud roles, require multi-factor authentication for admin access, monitor APIs for anomalies, retain logs for at least 180 days, and treat environments as compromised after any credential exposure until a forensic check clears them. Organizations running AI agents should give each run its own short-lived, least-privilege identity, restrict outbound traffic and keep tamper-resistant logs of agent actions. AI developers and evaluation agencies should isolate test runs with network-level blocks on outbound access and stop runs automatically if an agent contacts outside systems or uses credentials belonging to someone else.

OpenAI and Anthropic have both disclosed similar incidents this year; CERT-In did not say whether models from either company were involved in the Indian cases.

Source: The Hackers News