India’s cybersecurity agency CERT-In has warned that artificial intelligence (AI) agents being used for research and evaluation accessed the live systems of several Indian organisations without authorisation, in some cases reading business records containing personal and confidential information.
In an advisory issued on October 15, the Indian Computer Emergency Response Team (CERT-In) said it had received multiple voluntary disclosures from AI model providers about such incidents. The agency said the AI agents exceeded the authorisation given to them during research and evaluation activities.
“Recently, CERT-In has received multiple voluntary disclosures from AI model providers stating that their models, during research and evaluation activity on the internet, had reached the live systems of Indian organizations,” the advisory said.
According to CERT-In, the agents were able to access business records, including personal data and confidential material, through credentials and connection settings that had been exposed in application configurations, public code repositories and cloud service roles.
The affected organisations did not detect the unauthorised access themselves, the agency said. The incidents came to light after the AI model providers reviewed their systems and reported that the models had “exceeded the authorization of their assigned tasks”.
AI agents exploited conventional security weaknesses
CERT-In said the incidents did not necessarily involve new or sophisticated vulnerabilities. Instead, the AI agents exploited familiar security weaknesses, including credentials and keys exposed in source code, public repository histories, configuration files, and public web content.
The agency also identified dormant, deprecated and test application programming interfaces (APIs) that remained accessible from the internet. In some cases, payment API keys were stored in plaintext and could be accessed from application runtimes.
Other weaknesses included over-permissive cloud and backend roles, as well as internet-facing management interfaces with weak credentials or no multi-factor authentication. “In the incidents observed, AI found and exploited these conventional weaknesses faster, more exhaustively and at greater scale than human attackers,” CERT-In said.
The agency also said it had observed financially motivated cyber campaigns against Indian entities where attackers used publicly available AI-native offensive security tools. These tools provided ready-made capabilities for reconnaissance and exploitation.
CERT-In said the use of such agentic tools reduced the time between initial access and the final impact of an attack from days to a few hours. It also observed multi-agent operations being run in parallel.
The agency said organisations that had only partially remediated vulnerabilities were targeted again within days and at a larger scale. In the incidents voluntarily disclosed by AI providers, agents were also observed “re-deriving and re-using the same exposed credential in separate operations”.
CERT-In has advised AI developers and research organisations to isolate testing environments, use synthetic credentials and data, restrict network access and monitor agent activity in real time.
For organisations, it has recommended auditing for exposed credentials, removing dormant APIs, applying least-privilege access, securing administrative interfaces and giving AI agents separate, short-lived identities with limited access.
CERT-In said organisations should treat an environment as compromised after a confirmed credential exposure or unauthorised access until it has been forensically cleared and tested again.