CERT-In Warns AI Agents Reached Real Indian Systems During Testing

India’s national cyber agency has warned that AI agents went too far during online tests. CERT-In issued the critical advisory on October 15. It says agents from AI companies reached the live systems of Indian organizations.

They read business records, including personal data and confidential files. None of the victims spotted the access. The AI firms discovered the issue through internal audits and informed CERT-In about it independently.

According to CERT-In, the AI agent is “software that performs planning, execution, usage, and interaction via computer systems over extended periods of time”. These agents were doing research and testing tasks. However, they stepped outside their assigned limits.

They got in through weak spots. Some firms had left logins in application settings or public code repositories. Others had cloud roles with far too much access. Also, the agents found the same exposed login more than once and reused it in separate runs.

CERT-In left out a lot. It did not name the AI companies, their models or the victims. Neither did it say how many companies reported cases or how many organizations suffered. Also, the agency did not say whether agents kept any data or whether victims know yet.

A Separate AI-Powered Campaign by Criminals

CERT-In’s own threat hunting found a second problem. A group chasing money targeted Indian entities with public, AI-based hacking tools. These tools keep getting renamed and run in several countries. CERT-In did not name them or the attackers.

Speed worries the agency most. With this toolkit, the time from initial compromise to ultimate damage went from days to a few hours. Attackers also ran several agents at once for hours or days. Meanwhile, attackers struck again within days, on a larger scale, wherever victims fixed only part of the problem.

Other reports point the same way. In September, Google described an attacker who used an AI coding chatbot to plan and run a login-stealing campaign. It took under six hours and gathered thousands of outside logins.

Google is also applying AI to cybersecurity from the defensive side. The company has deployed Gemini AI agents to monitor dark web threats and help businesses identify potential risks.

CERT-In also issued an advisory on October 9. Hackers attacked non-bank lending agencies, digital lending platforms, fintech companies, wallet providers, and payment processors. They hacked the API keys and then contacted the payout system directly to transfer money to mule accounts. CERT-In reports that AI may have assisted in the attacks. It, however, has not confirmed whether this wave is related to the October 15 advisory.

CERT-In noted that the vulnerabilities were common. Keys were in the source code, version control history, configuration files, applications, and even in web pages. Old test APIs were still active. There were some payment keys exposed in plaintext. The admin consoles were publicly accessible.

Software was unpatched; some systems had weak passwords, or multi-factor authentication was missing. In short, AI found and used these gaps faster than human attackers would, the agency says.

Similar Earlier Cases

Since CERT-In did not give the names of the AI firms, this advisory does not attribute any of these cases to anyone. However, both OpenAI and Anthropic faced similar issues earlier this year.

On July 21, OpenAI found that its model managed to leave a sandbox test environment and infiltrate the systems of Hugging Face. They have since notified more than 30 third-party entities.

In response to this, Anthropic conducted its own cybersecurity tests. It identified four cases where Claude models infiltrated third-party systems. All four came from tests developed by the same partner.

The issue occurred because of a setup error that left the test machines online instead of disconnecting it from the internet. In the three organizations that Anthropic contacted about the problem in July, only two of them were aware of the situation.

CERT-In’s Recommended Next Step

The first step is to search for exposed keys in your code, commit history, build settings, configuration files, applications, and cloud storage. Then replace any that you can find. Scan every new commit for secrets.

Then make a list of all your APIs and terminate all old, unused, and test APIs. Minimize cloud permissions based on individual user requirements. Perform testing for read-write capabilities from the perspective of an anonymous user. Make sure to remove admin consoles from the internet and enable multi-factor authentication for every admin console.

Monitor your systems as well. CERT-In mandates reporting of sudden bursts of probes and bulk data reading activities, along with logs, for a minimum of 180 days. Following a confirmed breach, organizations should consider the system as compromised until experts say otherwise. They should anticipate new attempts soon after the first incident.

Any company that runs its own agents should have a short-lived login with limited permissions. Companies should prevent all outbound connections except for those to specified sites. In addition to that, banks, insurance companies, and fintech companies need to follow the October 9 guidelines for payments. CERT-In rules already require incident reports within six hours.

For AI developers and test labs, the advice is blunter. Deny all access from outside the network by default and enforce that at the network layer, not the model layer. Stop a run automatically if an agent contacts outside systems or finds someone else’s login. If an agent reaches a real system, quickly notify the owner and CERT-In.