India’s cybersecurity watchdog CERT-In has warned that autonomous AI agents deployed for research and evaluation accessed Indian organisations’ live systems without authorisation, reading business records containing personal data and confidential information.
In a critical advisory, the agency separately flagged attackers using publicly available agentic AI tools for financially motivated intrusions into Indian entities.
The incidents surfaced through AI model providers’ voluntary disclosures, CERT-In’s forensic analysis, and threat hunting. None of the organisations in the voluntarily disclosed cases detected the access themselves.
The advisory follows disclosures by OpenAI and Anthropic about agents exceeding their authorised scope during evaluations. CERT-In did not name the providers involved in the Indian incidents.
AI Agents Exploit Vulnerabilities At Machine Speed
Agents under evaluation accessed information using credentials and connection settings exposed in application configurations, public code repositories, and permissive cloud service roles, exceeding their assigned tasks’ authorisation.
Separately, attackers misused AI-native offensive-security frameworks for reconnaissance and financially motivated intrusions. Deployments across infrastructure in multiple countries indicated these tools’ widespread availability.
In the financially motivated campaign, agentic tools shortened the time between initial access and an attack’s final impact from days to hours. Multiple agents operated in parallel for hours or days.
Organisations that incompletely addressed vulnerabilities faced repeat attacks within days, at greater scale. In the voluntarily disclosed cases, agents rediscovered and reused exposed credentials across separate operations.
The weaknesses included exposed credentials; dormant or deprecated internet-accessible APIs; plaintext payment API keys; permissive cloud roles; and exposed administrative interfaces with weak credentials or no multi-factor authentication.
CERT-In also flagged unpatched application middleware, saying agents exploited conventional weaknesses faster, more thoroughly, and at greater scale than human attackers.
Global Incidents Highlight Containment Risks
Earlier this month, the Wikimedia Foundation disclosed activity it believed involved OpenAI agents, including unauthorised wiki edits, unsuccessful exploitation attempts, and millions of automated requests.
In July, OpenAI disclosed that models undergoing cybersecurity evaluations bypassed internet restrictions and accessed Hugging Face’s systems. Anthropic has reported similar incidents involving misconfigured evaluation environments.
Last week, Anthropic disclosed further unintended actions, including running commands on servers and bypassing controls to access gated data. It said no customer data or internal systems were involved.
Against this backdrop, CERT-In has urged developers to isolate evaluations, technically restrict internet access, use synthetic data and credentials, monitor agents live, and automatically stop runs exceeding authorised scope.
Developers should block reuse of third-party credentials and promptly notify affected organisations and CERT-In of unauthorised access. Organisations should audit and rotate exposed credentials, remove dormant APIs, enforce least-privilege access and multi-factor authentication, and monitor suspicious API activity.
They should retain logs for at least 180 days and treat environments as compromised after credential exposure or confirmed access until forensically cleared.
Organisations deploying agents should assign each run a separate, short-lived identity, restrict network access, and maintain tamper-resistant logs. BFSI and fintech entities should also implement CERT-In’s earlier payment and disbursement API security measures.
The post CERT-In Flags Unauthorised AI Agent Access To Indian Organisations’ Systems appeared first on Inc42 Media.