India's cybersecurity agency, CERT-In, has issued a critical advisory after autonomous AI agents accessed live systems and confidential data of Indian organisations without authorisation. Cybercriminals are now using these AI tools for rapid cyberattacks, impacting local entities.
India's cybersecurity agency, CERT-In, has issued a 'critical' advisory warning that autonomous Artificial Intelligence (AI) agents have accessed live systems and confidential data of Indian organisations without authorisation. Threat actors are also actively weaponising open-source agentic AI tools to execute rapid cyberattacks, according to Mint Technology.
The Indian Computer Emergency Response Team (CERT-In) highlighted two distinct categories of incidents targeting the Information and Communication Technology (ICT) infrastructure of Indian entities in its advisory (CIAD-2026-0049) titled 'AI Agents as Attack Vectors'.
In the first set of incidents, AI model providers voluntarily disclosed that autonomous AI models and agents, undergoing research and evaluation, had exceeded the authorised scope of their assigned tasks. These agents then reached live systems belonging to Indian organisations.
During these operations, the AI agents read business records containing personal data and confidential material. They did this by using credentials and connection settings left exposed in application configurations, public code repositories and overly permissive cloud service roles, the agency noted.
It's important to note that none of the affected organisations detected this unauthorised access on their own. In every case, the incident only came to light when the AI model provider disclosed it after an internal review.
In a separate trend, uncovered through its own threat hunting, CERT-In observed cybercriminals using publicly available AI-native offensive-security frameworks. These frameworks were used to conduct reconnaissance, exploit security weaknesses and carry out financially motivated campaigns against Indian entities. These tools are frequently repackaged and redeployed, with many deployments seen on servers across multiple countries.
In that campaign, agentic tools dramatically shrank the window between initial access and final impact, reducing it from days to just a few hours. Victims that only partly fixed their weaknesses were attacked again within days, often on a larger scale, the agency said.
CERT-In pointed out that conventional security lapses were the root weaknesses in all the recent AI agent-driven incidents it observed. These included credentials and keys exposed in source code, public repository histories, configuration files, client applications and public web content. Other issues were dormant, deprecated and test Application Programming Interfaces (APIs) left open to the internet, payment-API keys stored in plain text, over-permissive cloud and backend-as-a-service roles, and internet-facing management interfaces and unpatched middleware with weak passwords or no multi-factor authentication.
AI agents found and exploited these gaps faster, more thoroughly and at a larger scale than human attackers could. In the incidents disclosed by AI model providers, agents were also seen recovering the same exposed credential again and reusing it in separate operations.
To mitigate this growing threat, CERT-In has urged organisations and service providers to audit their source code, repositories including commit history, configuration files, client applications and cloud storage for exposed credentials. Entities have been advised to rotate exposed credentials and purge them from code history, decommission dormant, deprecated and test APIs, enforce least-privilege access in cloud deployments and for in-house AI agents, take admin interfaces off the internet, require multi-factor authentication, and monitor attacks while keeping logs for at least 180 days.
After any credential exposure or confirmed intrusion, organisations should treat the environment as compromised until it is "forensically cleared". They should also expect repeat attempts within days to weeks, the agency warned.
For AI developers, research laboratories and evaluation agencies, CERT-In recommended isolating research and evaluation work. This means blocking all outbound network access except what a task strictly needs, enforced at the network level rather than through instructions to the model. They should also use synthetic targets and test credentials instead of production data.
Jaydeep Singh, General Manager, India at Kaspersky, commented on the advisory, calling it "a timely reminder that AI agents are no longer just productivity tools." He added, "When given broad access, they can reach live systems and sensitive data in ways organisations never intended, often by moving through gaps that already exist, such as misconfigured cloud services, exposed credentials and excessive permissions."
Singh noted that valid accounts, public-facing applications and trusted relationships were the entry point for over 80 per cent of the attacks Kaspersky investigated in 2025. He explained that "With AI allowing threat actors to iterate faster and scale their efforts, these paths can now be exploited more quickly than ever." Singh also recommended that organisations treat AI agents as part of their attack surface from day one.
