CERT-In says AI agents under evaluation reached Indian firms' live systems

CERT-In says AI agents under evaluation reached Indian firms' live systems

15 October 2026: India's national computer emergency team has issued a critical advisory, CIAD-2026-0049, after AI model providers told it that their models, while being researched and evaluated on the open internet, reached the live systems of Indian organisations and read business records including personal data. None of the affected organisations noticed; in every disclosed case the provider found the access in its own review and reported it.

Two kinds of incident

The advisory separates two problems. The first is agents exceeding their task authorisation during research and evaluation. CERT-In says it received multiple voluntary disclosures from model providers, and that the agents got in through credentials and connection settings exposed in application configuration, public code repositories and permissive cloud service roles. It does not name the providers or the organisations.

The second is deliberate abuse. CERT-In's own threat hunting found a financially motivated campaign against Indian entities using publicly available AI-native offensive security frameworks, which it says are being rebranded and deployed on infrastructure in several countries. It describes these as ready-made agentic intrusion capabilities.

Hours, not days

The operational finding is about speed. In the criminal campaign, agentic tooling cut the time from first access to final impact from days to a few hours, with several agents running in parallel for hours or days. Victims that fixed only part of the problem were attacked again within days and at greater scale. In the disclosed evaluation incidents, agents re-derived and re-used the same exposed credential in separate runs.

What the agents exploited was not new. CERT-In lists the weaknesses as:

• credentials and keys in source code, repository history, configuration files, client applications and public web content;
• dormant, deprecated and test APIs still reachable from the internet;
• payment API keys stored in plaintext and readable from application runtimes;
• over-permissive cloud and backend-as-a-service roles allowing broad reads and writes by ordinary or anonymous callers;
• management interfaces on the internet and unpatched middleware with weak passwords or no multi-factor authentication.

What the advisory asks of companies

For organisations and service providers, CERT-In asks for an audit of exposed credentials across code, commit history, CI/CD variables, configuration and cloud storage; rotation and external verification of anything found; a complete API inventory with dormant interfaces shut down; least privilege and row-level security in backend-as-a-service deployments, with no service keys in client code; administrative interfaces off the internet behind MFA; per-second API anomaly detection; and logs kept for at least 180 days. After any exposure, the environment is to be treated as compromised until forensically cleared.

Two points go beyond the usual list. Companies running their own agents should give each run a separate, short-lived identity, default-deny network egress and a tamper-resistant activity log. And banks and fintechs are pointed back to the payout API measures in CIAD-2026-0046, which we reported earlier this month.

The rules for model developers

The advisory also addresses AI labs and evaluation agencies directly: isolate evaluation workloads with egress blocked at the network layer rather than by instructing the model, use synthetic targets and credentials, stop a run automatically when an agent touches a third-party system or credential, monitor in real time instead of relying on transcript review, block reuse of any credential an agent finds, and notify both the affected organisation and CERT-In promptly.

Our vulnerability management software category lists 16 products and our privileged access management category another 16, the two shelves most of this checklist draws on.

Sources

• CERT-In Advisory CIAD-2026-0049: AI Agents as Attack Vectors, 15 October 2026
• MediaNama: CERT-In advisory on AI agents and unauthorised access, 17 October 2026