CERT-In Warns: AI Agents Reached Real Indian Systems

AI Agents Wandered Into Real Indian Company Systems. Here’s What You Should Do Now

India’s national cyber agency, CERT-In, says AI agents being tested online accidentally got into live company systems and read private data. Separately, attackers are using AI agent tools to break in faster than ever. The cause in both cases is the same: leaked keys and loose permissions. The good news is that you can fix those today.

What happened

On October 15, 2026, CERT-In published an advisory with two separate stories.

1. Test agents that went too far.
Several AI companies were testing their agents online. During those tests, the agents stepped outside their assigned tasks and reached real systems belonging to Indian organizations. They read business records, including personal data and confidential files. None of the affected organizations noticed.

The AI companies spotted it in their own reviews and reported it to CERT-In voluntarily. CERT-In hasn’t said which companies, models or organizations were involved. It also hasn’t said whether any data was copied or kept.

2. Attackers using AI agent toolkits.
CERT-In’s own threat hunting found a money-driven campaign against Indian targets. The attackers used publicly available, AI-powered offensive-security frameworks. These tools let them run several agents at once and go from first access to full damage in a few hours instead of days.

Victims who only half-fixed the problem were hit again within days, at a bigger scale.

How did the agents get in?

Nothing fancy. The doors were already open:

• Passwords and keys left in code, config files, old commit history and public repositories

• Cloud roles with far more permission than they needed

• Old, forgotten or test APIs still reachable from the internet

• Payment API keys stored in plain text

• Admin panels exposed to the internet, with weak passwords or no MFA

• Unpatched middleware

One detail stands out: in some cases the agents found the same leaked credential again and reused it in separate runs. A leaked key doesn’t go away on its own.

Your fix-it checklist

Clean up secrets

• Search your code, commit history, CI/CD variables, config files, mobile/web apps and cloud storage for exposed keys.

• Rotate anything you find, purge it from history, and check from the outside that it’s really gone.

• Add secret scanning to every commit and build, and keep credentials out of code, config files and databases.

Shrink your attack surface

• Make a full list of your APIs and shut down old, unused and test ones.

• Apply least privilege to cloud roles, and keep privileged keys out of client-side code.

• Test what an anonymous user can read and write on your system.

• Take admin interfaces off the public internet, require MFA for all admin access, and patch exposed middleware quickly.

Watch and respond

• Use rate-based anomaly detection, and alert on enumeration bursts, bulk reads and automated sign-ups.

• Keep logs for at least 180 days.

• If a credential was exposed, treat the environment as compromised until a forensic check clears it, then retest. Expect repeat attempts within days to weeks.

• Remember that CERT-In rules require you to report cyber incidents within 6 hours.

If you run AI agents yourself

• Give each run its own short-lived, least-privilege identity.

• Block outbound traffic except to the destinations that run actually needs.

• Keep a tamper-resistant log of agent actions, especially anything touching production systems and data.

If you build or test AI models

• Isolate your test runs and block outbound internet by default.

• Enforce that block at the network level. Telling the model not to go online isn’t a control.

If you’re in finance or fintech

• Also follow the payment and disbursement API measures in CERT-In’s October 9 advisory, which covered attackers stealing API credentials to push money into mule accounts.

The takeaway

AI didn’t create new weaknesses here. It made the old ones much faster to find and abuse. What once took an attacker days can now take hours, and an agent can try thousands of doors without getting tired.

So the basics matter more than ever: no secrets in code, tight permissions, no forgotten APIs, MFA everywhere.

Want to know if your keys and APIs are safe? Book a free consultation with GTIS (https://gtisec.com/). We'll help you spot the risks and fix them before attackers do.