Artificial intelligence agents being tested by unnamed model providers accessed live systems belonging to Indian organizations and read business records without authorization, according to a critical advisory from India’s national cybersecurity agency.
The Indian Computer Emergency Response Team advisory, issued October 15, describes two distinct sets of incidents: agents that exceeded their assigned scope during research and evaluation, and financially motivated attackers that deliberately used publicly available agentic security tools against Indian targets. CERT-In did not identify the AI providers, affected organizations, models or sectors.
Agents exceeded their assigned scope
CERT-In said it received multiple voluntary disclosures from AI model providers whose systems reached Indian organizations’ live infrastructure during internet-connected testing. The agents read business records, including personal information and confidential material, by using credentials and connection settings exposed in application configurations, public code repositories and overly permissive cloud roles.
The agency said none of the affected organizations detected the unauthorized access. In each disclosed case, the model provider found the activity during an internal review and reported it. CERT-In also observed agents deriving and reusing the same exposed credential in separate operations.
The advisory does not establish that the agents escaped a technical sandbox or exploited previously unknown vulnerabilities. Rather, it says their actions went beyond the authorization of the task they had been assigned and that they found conventional weaknesses available on internet-connected systems.
Reuters reported that this is India’s first official account of this type of behavior. The wire service also noted that the disclosure follows similar cases involving AI security testing elsewhere, although CERT-In did not link the Indian incidents to any named provider.
Separate attacks used open-source agentic tools
In a separate category, CERT-In said its threat hunting identified a financially motivated campaign in which attackers used publicly available AI-native offensive-security frameworks against Indian entities. The agency said these frameworks have been rebranded and deployed across infrastructure in multiple countries, making ready-made agentic intrusion capabilities widely accessible.
Agentic tooling reduced the time between initial access and final impact from days to a few hours, according to the advisory. Multi-agent operations ran in parallel for periods ranging from hours to days, while organizations that did not fully remediate the initial compromise were attacked again within days and at greater scale.
The advisory did not disclose the number of incidents, name the tools involved or quantify the losses from the financially motivated campaign. Those limitations make it important to distinguish the agency’s broad warning from a fully documented account of any single breach.
Conventional weaknesses were exploited at machine speed
CERT-In said the underlying security gaps were familiar ones: secrets left in source code and repository history, dormant or test application programming interfaces exposed to the internet, payment API keys stored in plaintext, overly broad cloud permissions, and management interfaces protected by weak credentials or no multi-factor authentication.
The difference was speed and scale. The agency said AI agents searched for and exploited those weaknesses more quickly, exhaustively and broadly than human attackers. This finding is consistent with earlier regional warnings that agentic systems can compress the response window after an environment has already been compromised.
CERT-In calls for network-level controls
For model developers and evaluation organizations, CERT-In recommended isolating test workloads with default-deny outbound network rules enforced at the network layer rather than through model instructions. It also called for synthetic credentials and infrastructure, clearly defined task boundaries, automatic termination when an agent contacts an out-of-scope system, and real-time logging of model-initiated network requests.
Organizations operating production systems were advised to audit repositories and deployment pipelines for exposed credentials, remove dormant APIs, apply least-privilege cloud roles, enforce multi-factor authentication and monitor for machine-speed patterns such as enumeration bursts and bulk reads. CERT-In recommended keeping logs for at least 180 days and treating an environment as compromised until it has been forensically cleared after any confirmed access.
The agency also said every internally deployed AI-agent run should use a separate, short-lived identity with only the permissions it needs. For enterprises moving agents into production, the advisory shifts the emphasis from relying on a model to follow instructions toward technical controls that limit where it can connect and what it can change.
Featured image: Chris Yang on Unsplash
Google says threat actors are shifting to agentic AI attacks