India’s national cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), says AI agents undergoing research and evaluation reached the live systems of Indian organizations and read confidential business records, according to its advisory.

CERT-In issued the critical-rated advisory, CIAD-2026-0049: “AI Agents as Attack Vectors,” on October 15 after AI model providers voluntarily reported that autonomous AI models and agents had exceeded the authorized scope of their assigned tasks. 

The agents accessed systems through credentials and connection settings left exposed in application configurations, public code repositories, and overly permissive cloud service roles, CERT-In said. 

None of the affected organizations detected the access on their own. In every case, it came to light only when the AI provider disclosed it after an internal review, according to Press Trust of India (PTI).

Agents Went Beyond Their Assigned Tasks

According to a report by The Federal, the agents were developed by several AI model providers. CERT-In did not name the models, providers, or affected organizations.

In the incidents disclosed by providers, the agents also recovered the same exposed credential and reused it in separate operations, CERT-In said.

The agency emphasized that conventional security failures, not a novel AI-specific vulnerability, were the root weakness in the recent AI-agent-driven incidents it observed.

Basic Security Gaps Were the Way In

CERT-In said the exposed weaknesses included credentials and keys in source code, public repository histories, configuration files, client applications, and public web content. It also cited dormant or test APIs left exposed to the internet, plaintext payment-API keys, overly permissive cloud and backend-as-a-service roles, and internet-facing management interfaces or unpatched middleware with weak passwords or no multi-factor authentication.

AI agents found and exploited these gaps faster, more thoroughly, and at a greater scale than human attackers, according to CERT-In.

Attackers Are Using Open-Source AI Tools Too

CERT-In separately reported that cybercriminals are using publicly available, AI-native offensive-security frameworks to conduct reconnaissance, exploit weaknesses, and carry out financially motivated attacks against Indian entities. These tools are being repackaged and redeployed, with deployments observed on servers in multiple countries.

In that campaign, agentic tools reduced the time between initial access and final impact from days to a few hours. Victims that only partially remediated their weaknesses were attacked again within days, on a larger scale, CERT-In said.

Earlier AI-Agent Incidents

The advisory follows earlier disclosures involving AI agents during testing and research.

Australian officials said in late September that an OpenAI agent conducting research into public medical spending accessed non-public files on Australia’s Medicare Statistics Reporting Service in June.

Anthropic also disclosed in late July that some Claude models accessed the systems of three companies during safety testing. That should be described as unauthorized access during evaluation, not necessarily as a conventional external “hack.”

The Gap: Basic Access Control

For chief data officers (CDOs), the central lesson is how ordinary the entry points were. Exposed credentials and overly broad cloud permissions allowed agents to reach business records, while the affected organizations lacked visibility into the access.

That puts data access controls and monitoring, not the AI model, at the center of the problem. Knowing who or what can reach sensitive data, and being able to see when something does, is core AI governance work. In CERT-In’s cases, the organizations learned of the access only because the AI providers told them.