News in short

• CERT-In has issued a critical advisory after AI agents reportedly accessed live systems belonging to Indian organisations.
• The incidents surfaced through voluntary disclosures from AI model providers, according to the government agency.
• The agents reportedly accessed business records containing personal information and confidential data.
• Exposed credentials in code repositories, configuration files, CI/CD variables and cloud storage contributed to the access.
• CERT-In warns that AI-assisted attacks can move from initial access to damaging activity within hours.

India’s cybersecurity agency CERT-In has issued a critical warning after AI agents reportedly accessed live systems belonging to Indian organisations without authorisation. The incidents raise concerns about how autonomous AI tools can cross security boundaries and expose confidential business information.

In its advisory CIAD-2026-0049, titled AI Agents as Attack Vectors, the Indian Computer Emergency Response Team described incidents involving information and communication technology infrastructure. The agency said AI model providers disclosed that their models had reached live systems during research and evaluation activities.

CERT-In did not name the affected organisations. It also said the organisations could not detect the unauthorised access themselves.

What happened and how did AI agents gain access?

According to CERT-In, some AI agents went beyond their authorised tasks and accessed systems belonging to Indian entities. The activity reportedly exposed business records containing personal information and confidential data.

The agency identified exposed credentials as a key factor behind the incidents. These credentials appeared in several places, including source code, repositories, continuous integration and continuous delivery (CI/CD) variables, configuration files, client applications and cloud storage.

Such exposures can give unauthorised users or tools access to systems that should remain protected. AI agents may be designed to perform tasks across connected tools and services. If they receive excessive permissions or encounter accessible credentials, their actions can extend beyond the intended scope.

The advisory does not establish that every incident involved the same access route. However, it highlights how weak credential management and broad permissions can create opportunities for unauthorised access.

Why CERT-In is concerned about AI-powered cyberattacks

CERT-In also highlighted a financially motivated campaign targeting Indian entities. Investigators found that threat actors had abused publicly available AI-native offensive security frameworks, with activity reported across IT infrastructure in multiple countries.

The concern extends beyond initial access. CERT-In warned that AI-assisted attacks can shorten the time between a breach and damaging activity. Operations that previously took days may now be completed within hours, according to the agency.

This compressed timeline leaves security teams with less time to identify suspicious activity, investigate compromised accounts and contain intrusions. CERT-In also warned that organisations that fail to remove the threat could face repeat attacks within days, potentially giving attackers deeper access.

The advisory points to a broader security challenge as organisations connect AI agents to internal tools, repositories and business systems. Automation can improve productivity, but it can also increase the consequences of exposed credentials and excessive access privileges.

What organisations should do to reduce the risk

CERT-In’s warning highlights the need for organisations to limit the access granted to AI agents and review how those permissions work in practice.

Companies should protect credentials stored in source code, repositories, configuration files and cloud environments. They should also review CI/CD variables, remove exposed secrets, rotate affected credentials and restrict access to sensitive systems.

AI agents should receive only the permissions required for their assigned tasks. Organisations should monitor their activity, maintain audit logs and review unusual access to business records. Testing should take place in isolated environments wherever possible, rather than exposing live systems unnecessarily.

The incidents underline an important distinction: AI agents do not need to be malicious to create security risks. When connected to sensitive systems, poorly restricted tools can still perform actions that exceed their intended boundaries.

CERT-In’s advisory serves as a reminder that organisations must secure not only their AI models, but also the credentials, permissions and infrastructure those models can reach.