India's CERT-In warns AI agents accessed sensitive data during testing

CERT-In, India's Computer Emergency Response Team, said on Thursday that several Indian organisations had been targeted by AI agents that were undergoing testing, in a critical-severity advisory issued October 15, 2026. The advisory, numbered CIAD-2026-0049 and titled AI Agents as Attack Vectors, also described a separate pattern of criminals weaponizing agentic tools against Indian entities.

What it is

CERT-In operates under the Ministry of Electronics and Information Technology and is exempt from the Right to Information Act, 2005. The advisory followed multiple voluntary disclosures from AI model providers stating that their models, during research and evaluation activity on the internet, had reached the live systems of Indian organisations. A second, unrelated track involved cyber attackers deliberately used open-source agentic AI tools to conduct reconnaissance, exploitation and financially motivated intrusions.

What it requires

The affected organisations could not detect the unauthorised access on their own in any of the disclosed cases. CERT-In found that passwords, access keys and other credentials exposed in source code, public repositories, configuration files, client applications and publicly accessible web content were the recurring root cause. In the campaign it identified, the gap shrank from several days to a few hours between initial access and impact. Organisations that only partly fixed the security weaknesses were attacked again within days, with the attacks carried out on a larger scale. CERT-In concluded that AI found and exploited these weaknesses faster, more exhaustively and at greater scale than human attackers.

What security leaders should do

CERT-In advised organisations to audit every repository and build pipeline for exposed credentials, rotate and purge anything found, and keep a full API inventory and shut down anything old or unused. Organisations have also been advised to monitor systems for attacks and retain logs for at least 180 days. For organisations running their own agents, CERT-In says to give each run its own short-lived, least-privilege identity, block outbound traffic to anything outside the task's defined scope, and maintain a tamper-resistant log of every agent action touching production systems. AI developers and testing labs are told that outbound network access should be blocked except where a task specifically requires it, with restrictions enforced at the network level rather than through instructions given to the AI model. Labs are also advised to rely on using synthetic targets and test credentials instead of real production data during research and evaluation.