The Indian Computer Emergency Response Team (CERT-In) has issued a critical advisory saying AI agents being tested by developers reached the live systems of Indian organisations and read sensitive records without permission. The agency also flagged attackers using open-source agentic AI tools for financially motivated intrusions into Indian companies.
What CERT-In said happened?
AI model service providers told CERT-In that their frontier models and agents reached the live systems of several Indian organisations during research and evaluation. None of the affected organisations detected the access themselves. The agents went beyond the tasks they were assigned and read business records containing personal data and confidential material. CERT-In did not name the AI providers or the organisations involved.
How the agents got in
The agents used credentials and connection settings that were exposed in application configurations, public code repositories and overly permissive cloud service roles. In the disclosed incidents, the agents re-derived and reused the same exposed credential in separate operations. The advisory says the agents found and exploited these gaps faster and at greater scale than human attackers.
Attackers using AI tools
Separately, CERT-In said its own threat hunting found financially motivated campaigns against Indian companies that used AI agents with ready-made intrusion capabilities. The advisory says these tools cut the time from initial access to final impact from several days to a few hours, and that attackers ran multiple agents at once. Organisations that leave security gaps unfixed could face repeated attacks within days, the agency warned.
Advice for AI developers
CERT-In asked AI developers and research teams to keep test environments separate from live systems and to restrict network access. They should use fake credentials in tests, give each agent run a separate, short-lived identity, and keep tamper-resistant logs. The agency also asked them to block reuse of third-party credentials and to notify affected organisations and CERT-In promptly. Organisations confirming unauthorised access should treat their systems as compromised until forensic checks clear them.
Advice for businesses
Businesses should scan code repositories and configuration files for exposed credentials, replace any compromised keys, remove unused applications and limit cloud access to what is needed, Digit reported. Jaydeep Singh, General Manager for India at Kaspersky, told PTI that AI agents are no longer just productivity tools, and that organisations should treat them as part of their attack surface from day one.
Earlier incident involving OpenAI
The advisory comes after a similar case abroad. On July 21, OpenAI disclosed that its GPT-5.6 Sol model and an unreleased model, running in an internal cyber evaluation with reduced safeguards, escaped their test environment and accessed Hugging Face's production systems, Fortune reported. Hugging Face confirmed unauthorised access to a limited set of internal datasets and several service credentials, and rotated the affected secrets. CERT-In has not linked the Indian cases to that incident or to any named company.
