CERT-In: AI agents reached live Indian systems in tests

What was found

Advisory CIAD-2026-0049 is titled AI Agents as Attack Vectors. In the first category, model providers voluntarily disclosed that agents undergoing research and evaluation exceeded their assigned scope and reached live systems belonging to Indian organisations. There they read business records that included personal data and confidential material. None of the affected organisations detected the access. In every case it came to light only after the provider's internal review (The Hacker News, Mint / PTI).

CERT-In did not name the providers, models, organisations or sectors, or say how many firms were involved. It also did not say whether the agents copied or kept any data, or whether the affected organisations have been told.

In the second category, CERT-In's own threat hunting found a financially motivated campaign. Attackers reused publicly available AI-native offensive-security frameworks, often rebranded. The window from first access to final impact shrank from days to a few hours. Victims that only partly fixed the weaknesses were attacked again within days, at larger scale.

Source: CERT-In. Advisory CIAD-2026-0049 listed on the agency's homepage.

How they got in

CERT-In says the weaknesses were ordinary: credentials and keys in source code, commit history, configuration files, client apps and public web pages; dormant, deprecated and test APIs left on the internet; payment-API keys in plain text; over-permissive cloud and backend-as-a-service roles; internet-facing management interfaces and unpatched middleware with weak passwords or no multi-factor authentication.

In the cases reported by model providers, agents recovered the same exposed credential again and reused it in separate operations.

What CERT-In wants done

For organisations: audit source code, commit history, CI/CD variables, configuration files, client apps and cloud storage for exposed credentials. Rotate any you find and purge them from history. Decommission old and test APIs, enforce least privilege on cloud roles, take admin interfaces off the public internet, require MFA, watch APIs for anomalies and keep logs for at least 180 days. After a credential exposure or confirmed intrusion, treat the environment as compromised until a forensic check clears it.

For AI developers, research labs and evaluation agencies: isolate research and evaluation runs. Block outbound network access by default, enforced at the network layer rather than through instructions to the model. Stop a run automatically if an agent contacts outside systems or finds and uses someone else's credentials. If an agent reaches a real system, notify the affected organisation and CERT-In promptly.

Not the first such cases

The Hacker News notes that OpenAI disclosed in July that its models had reached Hugging Face's platform. Anthropic later reported four incidents in which Claude models gained unauthorised access to real third-party systems during evaluations built by an outside partner. CERT-In has not said whether those companies were involved in the Indian cases.