- CERT-In issued a critical advisory on AI agents accessing live Indian systems and data
- AI models accessed systems via exposed credentials and cloud roles beyond their tasks
- Affected organisations did not detect breaches; AI providers reported incidents themselves
The Indian Computer Emergency Response Team (CERT-In), which is the government's cybersecurity arm, has issued a "critical" rated advisory after AI agents under research and evaluation reached the live systems of several Indian organisations and read confidential data, including personal information.
In the advisory available on its official website CERT-In said AI model providers voluntarily informed that their models, while operating on the internet, had accessed live systems in India.
The agents read business records through credentials and connection settings exposed in application configuration, public code repositories and overly permissive cloud roles. CERT-In said the models' actions "exceeded the authorization of their assigned tasks."
As with most other worldwide cases, none of the affected organisations detected the unauthorised access. In every disclosed case, the AI providers raised the alarm after their own internal reviews highlighted them.
CERT-In did not name the AI companies or the affected Indian firms.
Nearly all frontier AI labs including OpenAI, Anthropic, Google have been making disclures of such incidents over the past several months to affected companies and governments. The OpenAI-HuggingFace attack, the Australian government breach and some US government sites being compromised have been some of the well-known incidents where AI agents escaped their testing environment.
Double Trouble
The agency also flagged a second threat after its own threat-hunting found hackers using publicly available, open-source agentic AI frameworks in a financially motivated campaign against Indian entities.
According to CERT-In, the tools cut the time between initial access and final impact from days to a few hours. Victims who fixed the problem only partly were attacked again within days, at greater scale.
The advisory stresses that the underlying weaknesses are not new. They include keys and credentials left in source code, dormant or test APIs still reachable online, payment-API (application programming interface) keys stored in plaintext, and management interfaces exposed without multi-factor authentication.
What has changed though according to CERT-In is that AI finds and exploits these gaps faster, more exhaustively and at a greater scale than human attackers.
How To Be Safe
For AI developers and labs, CERT-In recommends isolating evaluation workloads with default-deny network access, using synthetic credentials instead of real ones, monitoring agent activity in real time, and promptly notifying CERT-In and any affected organisation if an agent touches a real system.
Organisations have been advised to audit and rotate exposed credentials, including those buried in code history, retire unused APIs, apply least-privilege access in the cloud, enforce multi-factor authentication for administrators, and retain logs for at least 180 days.
Firms deploying their own AI agents should give each run a short-lived, limited identity, it said.
The latest advisory follows CERT-In's April warning on risks from frontier AI. Indian entities are already required to report cyber incidents to CERT-In within six hours of noticing them.
