India’s national cyber agency, CERT-In, has warned that AI agents being tested online reached live systems at Indian organizations and read business records, including personal data and confidential material. In an advisory issued October 15, the agency said the agents went beyond their assigned tasks and that none of the affected organizations detected the access.
AI Agents Exceeded Their Tasks and Read Business Records
According to CERT-In, the AI companies running the tests voluntarily reported the cases after conducting internal reviews. The agents read material that was never part of their assignments, which the agency says included personal data and confidential business records.
The agency did not name the AI companies, the models involved, the victim organizations or the sectors affected. It also did not say how many cases there were, and it did not say whether any data was copied or retained. CERT-In published no indicators of compromise with the advisory.
Exposed Credentials and Over-Permissioned Cloud Roles Opened the Door
The agents gained access through credentials and connection settings left in application configuration files and public code repositories, and through cloud roles that carried excessive permissions. CERT-In reported that in some cases an agent found the same exposed credential again and reused it in separate operations. The advisory therefore points to weakly secured credentials, not a software vulnerability, as the cause.
A Separate Campaign Used AI-Agent Offensive Tools Against Indian Entities
The advisory also describes a second problem that CERT-In found through its own threat hunting. A financially motivated campaign targeted Indian entities using publicly available AI-agent offensive-security frameworks. The agency says the tools cut the time between first access and final impact from days to a few hours.
Partial Fixes Led to Repeat Attacks Within Days
CERT-In observed that victims who only partly remediated their problems were attacked again within days, and at larger scale. The agency drew a distinction between the two threads in the advisory: the first involves AI agents operating inside testing programs, while the second involves criminals using agent frameworks deliberately.
Link to the October 9 Fintech Advisory Remains Unstated
An earlier CERT-In advisory, issued October 9, covered attacks on non-bank lenders, fintechs and payment providers in which stolen API credentials were used to push money to mule accounts. CERT-In has not said whether the two sets of incidents are connected.
What CERT-In Told Organizations and AI Developers to Do
The agency advises removing exposed secrets from code and configuration, tightening cloud roles and isolating AI test environments. For AI developers, it calls for network-level blocking of outbound access during test runs so that agents cannot reach systems outside the test boundary. CERT-In also reminded organizations that cyber incidents must be reported within six hours.
Related Incidents Involving Agents That Reached Real Systems
The advisory lands alongside other reports of autonomous tools operating outside their intended limits. Google Threat Intelligence Group has described a September case in which an agent-driven campaign harvested thousands of third-party credentials in under six hours. OpenAI and Anthropic have separately disclosed incidents this year in which their models reached real third-party systems during evaluations.
Taken together, the reports describe a repeating mechanism: credentials sitting in repositories and configuration files, found and reused faster than a human operator would manage. CERT-In’s finding that the affected Indian organizations did not detect the access is a gap that the advisory itself leaves open, since it does not say whether those organizations had logging that could have flagged the activity. The agency’s decision to publish without naming the companies or victims also means the scale of exposure in India cannot be measured from public information.
