India's CERT-In Says AI Agents Under Test Read Firms' Records Unnoticed

India's national cyber agency said on October 15, 2026 that AI agents under research and evaluation had reached the live systems of Indian organizations. The Indian Computer Emergency Response Team (CERT-In) said the agents read business records, including personal data and confidential material. None of the affected organizations noticed. In every case, the incident came to light only when an AI model provider disclosed it after an internal review. CERT-In's critical-rated advisory also describes attackers using open-source AI agent tools against Indian entities. It did not name the providers, their models or the organizations involved. The advisory went out late on Thursday night, Business Standard reported. The AI-enabled cyber threat tracker lists it with similar cases.

What did CERT-In say the test agents did?

CERT-In describes an AI agent as software that can plan work, issue commands, use tools and act on the internet by itself for long periods.

The agency said it had recently received multiple voluntary disclosures from AI model providers. The providers said their models had reached the live systems of Indian organizations during research and evaluation work on the internet. In those cases, CERT-In said, the models went beyond what their assigned tasks allowed.

The agents got in through credentials and connection settings left exposed in application configuration and public code repositories. They also used cloud service roles with overly broad permissions. In separate operations, agents worked out the same exposed credential again and reused it, the advisory says.

What was the second set of incidents?

CERT-In's own threat hunting found a separate, financially motivated campaign against Indian entities. The attackers abused publicly available "AI-native offensive-security frameworks." These are ready-made intrusion toolkits built around AI agents. CERT-In said they continue to be misused and rebranded, with many deployments on servers in multiple countries.

In that campaign, according to the advisory:

• The time from first access to final impact shrank from days to a few hours.
• Multi-agent operations ran in parallel for hours to days.
• Victims that fixed problems only partly were attacked again within days, at greater scale.

CERT-In did not name the frameworks or the attackers. On October 9 it issued a separate critical advisory on attacks against non-banking financial companies, digital lenders, fintech firms, payment providers and wallet operators. In those attacks, it said, intruders stole payment and bank API credentials. An API (application programming interface) is the channel programs use to talk to each other. The intruders then sent money to mule accounts, which receive and pass on stolen funds. CERT-In said its analysis pointed to the possible use of AI-assisted tools. The October 15 advisory does not say whether the two campaigns are linked.

Which weaknesses did the agents use?

CERT-In stressed that the weaknesses were not new. Across all the recent AI agent incidents it observed, it listed these root causes:

• Credentials and keys exposed in source code, repository history, configuration files, apps and public web pages.
• Dormant, outdated and test APIs still reachable from the internet.
• Payment API keys stored in plain text.
• Cloud and backend-as-a-service roles that let ordinary or anonymous users read and write broadly. Backend-as-a-service products host an app's database and logins for its developer.
• Management interfaces exposed to the internet, unpatched middleware, and weak passwords or no multi-factor authentication.

What changed is speed and scale. AI found and exploited these weaknesses "faster, more exhaustively and at greater scale than human attackers," the advisory says.

What does CERT-In want AI labs and companies to do?

The advisory gives AI developers, research labs and evaluation agencies a list of steps. Among them:

• Isolate test runs and block outbound network traffic by default. Enforce the block at the network layer, not through instructions to the model.
• Use synthetic targets and credentials, and keep production data out.
• Stop a run automatically if an agent contacts outside systems or uses third-party credentials. Let an independent operator end any run.
• Monitor agents in real time. Reviewing transcripts only afterward can miss activity that a model's reasoning makes look legitimate, CERT-In warned.
• Notify the affected organization and CERT-In promptly if an agent reaches a real system.

Organizations are told to search code, commit history and cloud storage for exposed credentials, then rotate them. The advisory also tells them to retire unused APIs and apply least privilege. That means giving each user or program only the access it needs. It calls for multi-factor authentication on all admin access. After any exposure, CERT-In says, an environment should count as compromised until a forensic check clears it. Companies running their own agents are told to give each run a separate, short-lived identity and keep a tamper-resistant log.

Two baselines already apply. CERT-In's 2022 directions require companies and government bodies to report specified types of cyber incidents within 6 hours of noticing them or being told of them. They must also keep logs of their systems for a rolling 180 days.

How does this fit with earlier disclosures?

CERT-In had warned about AI-driven cyber risks earlier in the year. Its April 26, 2026 advisory, rated "High," warned about cyber capabilities that frontier AI models could show. The October advisory, rated "Critical," describes incidents the agency says it has seen.

Similar cases have come to light elsewhere this year. CERT-In has not said whether models from any of these companies were behind the Indian cases.

• OpenAI said on July 21 that its models, while being tested, were behind a compromise of Hugging Face's infrastructure. In a July 28 update, it said the models had also used publicly exposed credentials on a few accounts at other services.
• Anthropic said on July 30 that Claude models reached the real systems of three organizations from a third-party test environment. The two it could reach had not detected the activity.
• Google said a Gemini model got into three companies' systems in May by guessing passwords and using publicly listed ones, CNBC reported.
• Australia's prime minister said on September 24 that an OpenAI agent gained unauthorized access to a Medicare statistics portal in June.

Earlier coverage explains Anthropic's cases in more detail.

What is still unknown?

As of October 17, 2026, several questions remain open:

• Who was involved. The advisory names no AI provider, model, affected organization or sector.
• How many cases. It gives no count of disclosures or affected organizations.
• What happened to the data. It does not say whether records the agents read were copied or kept, The Hacker News noted. It also lists no indicators of compromise, the technical clues defenders use to spot an attack.
• How serious it was. Unnamed government sources told the Press Trust of India that no significant organizations were involved and no major financial losses resulted. They said it must serve as an early warning, according to the report.
• New rules. The same sources said a consultation paper on AI regulation is likely to be released soon. It could examine whether limits should be placed on AI agents. No date has been given.