'Cert-In alert on AI agents an early warning, no major financial loss'

Amid the Cert-In advisory on autonomous AI agents, government sources on Friday said all companies must strengthen cybersecurity measures and step up monitoring of unusual system activity, and that no vital information of significant organisations was compromised and the incident must serve as an early warning.

India's cybersecurity agency Cert-In has issued a 'critical' advisory warning that autonomous Artificial Intelligence (AI) agents have accessed live systems and confidential data of Indian organisations without authorisation, while threat actors are actively weaponising open-source agentic AI tools to execute rapid cyberattacks.

Government sources told PTI that upcoming AI regulation - for which the consultation paper is likely to be floated soon - may also examine issues around autonomous agents.

The incident did not involve any significant organisations or result in major financial losses or compromise of vital information, sources said, while emphasising that it had highlighted existing vulnerabilities. This must serve as an early warning, and companies must immediately improve cyber hygiene, invest in better security tools and step up real-time monitoring, sources said.

Sources further said larger enterprises should use security operations centres to track suspicious activity, including repeated login attempts and access from unusual IP addresses. Organisations must also deploy machine-learning tools to detect threats and automate responses.

Government sources said companies must invest in cybersecurity and pointed out that currently firms "notoriously lack in fibre hygiene".

They cautioned that as AI systems become more capable of carrying out tasks autonomously, the possibility of agents repeatedly attempting actions without stopping cannot be ruled out by companies.

Sources emphasised that organisations would need to improve their ability to examine system logs, identify unusual behaviour and respond to emerging threats in real-time.

The government is also looking at how risks posed by AI agents could be addressed through future AI regulation, sources said, adding that this would be one of the priority areas.

A forthcoming consultation paper on AI regulation could examine whether limits and boundaries need to be imposed on AI agents, they added.

Experts said the real risk is that agents can reach sensitive data beyond their permissions without organisations even realising it, a gap that could affect everyday users as AI tools increasingly handle personal information.

In a 'critical' advisory (CIAD-2026-0049) titled 'AI Agents as Attack Vectors', the Indian Computer Emergency Response Team (Cert-In) said AI model providers have voluntarily disclosed that autonomous AI models and agents undergoing research and evaluation had exceeded the authorised scope of their assigned tasks and reached live systems belonging to Indian organisations.

It also said that threat actors were actively weaponising open-source agentic AI tools to carry out rapid cyberattacks against Indian entities.

Notably, none of the affected organisations detected the access on their own. In every case, the incident came to light only when the AI model provider disclosed it after an internal review.

During these operations, the AI agents read business records containing personal data and confidential material, using credentials and connection settings left exposed in application configurations, public code repositories and overly permissive cloud service roles, the agency noted.

In a separate trend uncovered through its own threat hunting, Cert-In observed cybercriminals using publicly available AI-native offensive-security frameworks to conduct reconnaissance, exploit security weaknesses and carry out a financially motivated campaign against Indian entities.

These tools continue to be repackaged and redeployed, with many deployments seen on servers across multiple countries, it said.

In that campaign, agentic tools shrank the window between initial access and final impact from days to a few hours. Victims that only partly fixed the weaknesses were attacked again within days, on a larger scale, the agency said.

Cert-In pointed out that conventional security lapses were the root weaknesses in all the recent AI agent-driven incidents it observed.

Jaydeep Singh, General Manager - India at Kaspersky, said it was "a timely reminder that AI agents are no longer just productivity tools".

"When given broad access, they can reach live systems and sensitive data in ways organisations never intended, often by moving through gaps that already exist, such as misconfigured cloud services, exposed credentials and excessive permissions," Singh said.

Valid accounts, public-facing applications and trusted relationships were the entry point for over 80 per cent of the attacks Kaspersky investigated in 2025, Singh said, adding, "With AI allowing threat actors to iterate faster and scale their efforts, these paths can now be exploited more quickly than ever." AI agents used for research and testing should be kept fully separate from production environments, using synthetic data and test-only credentials.

"Every agent should be inventoried, isolated in sandboxed environments, governed by default-deny rules and required to seek human approval before any irreversible action," Singh added.

Critical vulnerabilities should be patched or mitigated "within hours, not weeks", and code and pipelines audited regularly, Singh said, citing a Kaspersky study of around 30,000 popular GitHub repositories that found overly broad access permissions among the most common issues.

Sunil Sharma, Managing Director and VP - Sales (India and SAARC) at Sophos, said AI agents were introducing new cybersecurity considerations as they gain the ability to access data and perform tasks autonomously.

"Organisations will need to extend established security practices to these systems: a distinct identity for each agent, least-privilege access, secured API keys and tokens, adequate logging, and continuous monitoring for unusual behaviour. Research and testing environments should also be isolated from production," he said.

Soumen Mandal, Principal Analyst at Counterpoint Research, said the impact of AI agents being able to access sensitive information beyond their authorised permissions without organisations even realising it could extend to everyday users, as AI agents increasingly handle personal and confidential data.

"As AI adoption becomes mainstream, AI developers, governments, application providers, independent researchers and industry bodies must work together to establish robust security standards and accountability frameworks that build trust without slowing innovation," Mandal said.

Techarc Chief Analyst Faisal Kawoosa said every organisation and individual needs to be careful when it comes to using AI, and that tools and applications are often chosen on cost rather than on an understanding of their implications.