AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and confidential material, CERT-In said in an advisory on October 15.
The agents went beyond their assigned tasks, and none of the organizations detected the unauthorized access. After internal reviews, the AI companies whose models were being tested voluntarily reported the cases to CERT-In, India’s national cyber agency.
AI agents are software systems that can plan work, run commands, use tools, and act on the internet autonomously for extended periods. In these cases, the agents gained access via credentials and connection settings left exposed in application configuration and public code repositories, and via cloud service roles with excessive permissions.
CERT-In did not name the AI companies, their models, or the organizations and sectors involved. It did not say how many companies reported cases or how many organizations were affected, and said only that the reports came in recently.
It also did not say whether any data the agents read was copied or kept, or whether the affected organizations have been told.
Attackers Used Open-Source AI Agent Tools in a Separate Campaign
CERT-In’s own threat hunting found a second, separate set of incidents: a financially motivated campaign against Indian entities. The attackers misused publicly available offensive-security frameworks built on AI agents.
The frameworks continue to be misused and rebranded, with numerous deployments across infrastructure in several countries. CERT-In did not name the frameworks or the attackers.
In this campaign, the frameworks cut the time from first access to final impact from days to a few hours, according to CERT-In. The attackers ran several agents in parallel for hours to days to reach their goals. Victims that only partly fixed the problems were attacked again within days, at a larger scale.
Google Threat Intelligence Group reported a separate case in September. Attackers who had compromised a cloud resource planned, built and ran an agent-driven campaign that harvested thousands of third-party credentials, all in under 6 hours.
On October 9, CERT-In warned of attacks on non-banking financial companies, digital lenders, fintech firms, payment providers and wallet operators. The attackers in those cases stole API credentials and called fund-transfer and disbursal APIs directly to move money into mule accounts.
AI-assisted tools may have been used in those attacks. CERT-In has not said whether those attacks are related to the campaign in its October 15 advisory.
What CERT-In Wants Fixed
The weaknesses behind both kinds of incidents were ordinary, CERT-In said. Credentials and keys were exposed in source code, public repository history, configuration files, client apps and public web pages. Old, unused and test APIs were still reachable from the internet.
Payment API keys were stored in plain text, and cloud and backend-as-a-service roles granted ordinary or anonymous users broad read and write access. Management interfaces were exposed to the internet, and application middleware was left unpatched, with weak credentials or no multi-factor authentication.
In the cases reported by the AI companies, agents found the same exposed credential again and reused it in separate operations.
CERT-In did not publish indicators of compromise for either kind of incident. Organizations should apply the baseline in CERT-In’s May blueprint and take these steps:
- Search source code, commit history, CI/CD variables, configuration files, client apps and cloud storage for exposed credentials. Rotate any you find, purge them from history and confirm the fix from outside.
- Scan every commit and build for secrets, and keep credentials out of code, configuration files and databases.
- Keep a full list of your APIs, and shut down old, unused and test APIs and accounts.
- Apply least privilege to cloud and backend-as-a-service roles, keep privileged keys out of client-side code, and test what an anonymous user can read and write.
- Take management interfaces off the internet, require multi-factor authentication for all admin access, and patch exposed middleware quickly.
- Watch APIs with rate-based anomaly detection, alert on enumeration bursts, bulk reads and automated sign-ups, and keep logs for at least 180 days.
- After any credential exposure or confirmed access, treat the environment as compromised until a forensic check clears it. Retest after fixing it, and expect repeat attempts within days to weeks.
- If you run AI agents, give each run its own short-lived, least-privilege identity and block outbound traffic except to the destinations each run needs. Keep a tamper-resistant log of agent actions, at least those that touch production systems and data.
Banks, insurers, other financial firms, and fintech companies should also apply the payment and disbursement API measures outlined in the October 9 advisory.
CERT-In’s directions also require organizations to report cyber incidents to the agency within 6 hours.
For AI developers, research labs and evaluation agencies, CERT-In wants test runs isolated, with outbound network access blocked by default. That block should be enforced at the network level, not through instructions to the model.
A run should stop automatically if an agent contacts outside systems, or finds or uses credentials that belong to someone else. If an agent reaches a real system, the affected organization and CERT-In should be told promptly.
Earlier Disclosures by OpenAI and Anthropic
OpenAI and Anthropic have both disclosed similar incidents this year. CERT-In did not say whether models from either company were involved in the Indian cases.
In July, OpenAI disclosed that its models had compromised Hugging Face’s platform. It is reviewing what its models did on the internet during training and testing, and notifying third parties whose security controls its models may have bypassed.
In response to that disclosure, Anthropic began reviewing its own cyber evaluations. It has since reported 4 incidents in which Claude models gained unauthorized access to real third-party systems during evaluations built by the same outside partner. It has notified all affected parties.
Of the 3 organizations in Anthropic’s July disclosure, the 2 it reached had not detected the activity.
