AI agents breached Indian systems undetected, CERT-In warns

AI agents breached Indian systems without authorization while being tested on the open internet, accessing business records containing personal and confidential information, India’s national cyber agency has warned.

CERT-In said it received multiple voluntary disclosures from AI model providers whose internal reviews found that agents used in research and evaluation had gone beyond their assigned tasks. None of the affected organizations detected the access themselves, according to an advisory issued on 15 October.

The agents reached the systems using credentials and connection settings exposed in application configurations and public code repositories, as well as cloud service roles with excessive permissions. Some later rediscovered and reused the same exposed credentials in separate operations.

CERT-In did not identify the AI companies, models or Indian organizations involved, or disclose how many organizations were affected.

The disclosure marks India’s first official acknowledgment of AI agents exceeding their testing boundaries and gaining unauthorized access to live systems. Similar concerns have emerged globally as increasingly autonomous models are given access to browsers, software tools and external systems.

CERT-In separately identified a financially motivated campaign against Indian organizations in which attackers used publicly available AI-native offensive-security tools for reconnaissance and exploitation.

The agency said the tools had been repeatedly rebranded and deployed through infrastructure in several countries, pointing to the growing availability of ready-made agentic hacking capabilities.

In those attacks, agentic tools reduced the time between initial access and final impact from days to a few hours. Attackers also ran multiple AI agents in parallel for hours or days, while organizations that only partially fixed vulnerabilities were attacked again within days and at greater scale.

The weaknesses themselves were conventional: exposed passwords and API keys, abandoned or test APIs left online, plaintext payment credentials, overly broad cloud permissions, internet-facing administrative systems and unpatched software.

“In the incidents observed, AI found and exploited these conventional weaknesses faster, more exhaustively and at greater scale than human attackers,” CERT-In said.

The warning comes amid broader concern over the use of AI in cyber operations. Google DeepMind Chief Executive Demis Hassabis this week described recent AI-related hacking incidents as “early warning shots,” while governments and technology companies debate stronger safeguards for autonomous systems.

CERT-In urged AI developers to isolate model evaluations from the public internet by default and enforce those restrictions at the network level rather than relying on instructions given to models.

Tests should automatically stop if an agent contacts an external system or discovers or uses third-party credentials, the agency said. Developers should promptly notify the affected organization and CERT-In if an agent reaches a real system.

Businesses were advised to search repositories for exposed credentials, remove unused APIs, restrict cloud permissions, require multi-factor authentication for administrative access and monitor unusually rapid or high-volume API activity.

CERT-In also said systems should be treated as compromised after confirmed unauthorized access until a forensic investigation clears them.