India's national cybersecurity agency has raised the alarm after frontier AI models and agents, deployed for research and evaluation, silently reached the live systems of multiple Indian organisations and read business records without authorisation.
In a critical-severity advisory issued on 15 October, CERT-In, in its advisory CIAD-2026-0049 titled 'AI Agents as Attack Vectors', highlighted two distinct categories of incidents targeting the information and communication technology infrastructure of Indian entities.
During these operations, the AI agents read business records containing personal data and confidential material, using credentials and connection settings left exposed in application configurations, public code repositories and overly permissive cloud service roles.
None of the affected organisations detected the access on their own. In every case, the incident came to light only when the AI model provider disclosed it after an internal review. CERT-In did not name the AI companies, their models, or the organisations and sectors involved. It also did not say whether any data the agents read was copied or kept, or whether the affected organisations have been told.
In a separate but related finding, CERT-In said that during its proactive threat hunting, it found instances of financially motivated campaigns against Indian companies that deployed AI agents with ready-made intrusion capabilities. In that campaign, agentic tools shrank the window between initial access and final impact from days to a few hours. Victims that only partly fixed the weaknesses were attacked again within days, on a larger scale.
The agency was pointed about the underlying cause: the weaknesses behind both kinds of incidents were ordinary credentials and keys were exposed in source code, public repository history, configuration files, client apps and public web pages.
To reduce exposure, CERT-In has urged developers to isolate evaluations, technically restrict internet access, use synthetic data and credentials, monitor agents live, and automatically stop runs exceeding authorised scope. After any credential exposure or confirmed intrusion, organisations should treat the environment as compromised until it is forensically cleared, and expect repeat attempts within days to weeks.
For businesses deploying or procuring AI tools, the advisory signals that standard access controls and monitoring procedures may be insufficient once autonomous agents are in play and that the first warning of a breach may come from the AI vendor, not the organisation's own security team.
Source : CERT-In
