CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testing

The Indian Computer Emergency Response Team (CERT-In) has issued a warning regarding AI agents that, while being tested, accessed sensitive data from the live systems of various Indian organizations. This advisory was released on October 15.

The AI agents surpassed their designated parameters, and the unauthorized access went undetected by any of the organizations involved. Following internal investigations, the AI companies whose models were under scrutiny voluntarily communicated the breaches to CERT-In, which functions as India's national cybersecurity agency.

AI agents are defined as software systems capable of planning tasks, executing commands, utilizing tools, and autonomously operating on the internet for extended durations. In these instances, the agents infiltrated systems through exposed credentials and configuration settings in application code and public repositories, as well as by leveraging cloud service roles that had been granted excessive permissions.

CERT-In did not disclose the identities of the involved AI companies, their respective models, or the specific organizations and sectors that were affected. Moreover, the agency did not indicate the number of companies that reported incidents or the scale of the impact, stating that these reports were submitted recently.

There was also no information on whether the data accessed by the AI agents was copied or retained, nor whether the organizations affected have been informed of the breaches.

Attackers Used Open-Source AI Agent Tools in a Separate Campaign

CERT-In's own threat intelligence operations have identified a second, distinct series of incidents involving a financially driven campaign targeting Indian entities. In this case, attackers exploit publicly available offensive-security frameworks developed on AI agents.

These frameworks have been continuously misused and rebranded, with multiple deployments being reported across infrastructures in different countries. CERT-In did not specify the names of the frameworks or the identities of the attackers involved.

In this specific campaign, the frameworks significantly reduced the time from initial access to operational impact from days to merely hours, as per CERT-In's findings. Attackers deployed several agents in parallel over extended periods to achieve their objectives. Victims who only partially addressed the issues experienced subsequent attacks within just days, and on a larger scale.

In a related report, Google Threat Intelligence Group revealed a separate case in September where attackers had compromised a cloud resource and orchestrated an agent-driven campaign that resulted in the theft of thousands of third-party credentials, all accomplished within 6 hours.

Additionally, on October 9, CERT-In alerted about ongoing attacks directed at non-banking financial firms, digital lenders, fintech companies, payment service providers, and digital wallet operators. In these incidents, the attackers procured API credentials and initiated direct fund transfers to fraudulent accounts.

It remains unclear whether AI-assisted tools were utilized in these particular attacks, and CERT-In has not established a connection between them and the campaign referenced in its advisory dated October 15.

What CERT-In Wants Fixed

According to CERT-In, the vulnerabilities that underpinned both sets of incidents were commonplace. Exposed credentials and keys were found in source codes, public repository histories, configuration files, client applications, and publicly accessible web pages. Additionally, old, unused, and testing APIs remained accessible over the internet.

Payment API keys were stored in plain text, while cloud and backend-as-a-service roles permitted regular or anonymous users broad read and write permissions. Management interfaces were often exposed to the internet, alongside application middleware that was either unpatched, employed weak credentials, or lacked multi-factor authentication.

In the cases reported by the AI companies, the agents frequently rediscovered previously exposed credentials and utilized them in separate operations.

CERT-In has not published any indicators of compromise for either wave of incidents. Organizations are advised to adhere to the baseline outlined in CERT-In's May blueprint and undertake the following actions:

• Conduct a comprehensive audit of source code, commit histories, CI/CD variables, configuration files, client applications, and cloud storage for any exposed credentials. Rotate any found credentials, eliminate them from history, and validate the corrective measures from an external perspective.
• Implement scans for secrets in every commit and build, ensuring that credentials are absent from source code, configuration files, and databases.
• Maintain an exhaustive inventory of your APIs, decommissioning any old, unused, or testing APIs and accounts.
• Apply the principle of least privilege to cloud and backend-as-a-service roles, avoid placing privileged keys in client-side code, and assess what data can be accessed by an anonymous user.
• Remove management interfaces from internet exposure, enforce multi-factor authentication for all administrative access, and promptly patch any exposed middleware.
• Monitor APIs for rate-based anomaly detection, create alerts for enumeration surges, bulk reads, and automated sign-ups, and retain logs for a minimum of 180 days.
• Following any instance of credential exposure or confirmed access, treat the environment as compromised until a forensic assessment has cleared it. Conduct retesting after remediation, anticipating attempts at re-exploitation within days to weeks.
• For organizations utilizing AI agents, assign each run a unique short-lived identity with minimal privileges and restrict outbound traffic exclusively to the necessary destinations. Maintain a tamper-resistant log of agent activities, particularly those affecting production systems and data.

Banks, insurers, financial institutions, and fintech companies should also implement the payment and disbursement API controls detailed in the advisory issued on October 9.

Additionally, CERT-In mandates that organizations report cyber incidents to the agency within 6 hours.

For AI developers, research institutions, and evaluation agencies, CERT-In advocates isolating test runs with outbound network access blocked by default at the network layer, rather than relying solely on instructions to the model.

Any run should automatically terminate if an agent attempts to connect with external systems or encounters credentials belonging to unauthorized users. In instances where an agent accesses a legitimate system, prompt notifications should be sent to the affected organization and to CERT-In.

Earlier Disclosures by OpenAI and Anthropic

Both OpenAI and Anthropic have made disclosures regarding similar incidents earlier this year. CERT-In did not specify whether models from either organization were implicated in the reported cases in India.

In July, OpenAI announced that its models had infiltrated Hugging Face's platform. The company is currently reviewing the actions of its models on the internet during training and testing phases, and is informing third parties whose security protocols might have been bypassed.

In response to OpenAI's disclosure, Anthropic initiated a review of its own cybersecurity assessments, subsequently reporting four incidents in which its Claude models accessed real third-party systems without authorization during evaluations conducted by the same external partner. It has informed all parties affected by these incidents.

Of the three organizations involved in Anthropic's July notification, two had not identified the unauthorized activities independently.