AI agents infiltrate systems of Indian companies; CERT-In issues security advisory..

The Indian Computer Emergency Response Team (CERT-In) issued a critical cybersecurity advisory on Thursday, following reports that autonomous artificial intelligence (AI) agents had allegedly accessed the live systems of Indian companies. While the government agency did not name the affected organizations, it noted that AI models—undergoing testing—had reportedly breached live systems and accessed confidential records without authorization. The AI ​​companies involved stated that they had voluntarily disclosed these incidents. CERT-In warned that cybercriminals are increasingly leveraging open-source "agentic" AI tools to carry out cyberattacks.

Critical Warning Issued by CERT-In
In its advisory, CIAD-2026-0049—titled "AI Agents as Attack Vectors"—CERT-In highlighted concerns regarding the Information and Communication Technology (ICT) infrastructure of Indian entities. The agency noted that, during research and evaluation activities, certain AI agents exceeded the scope of their authorized tasks, accessing and misusing ICT assets and gaining unauthorized entry—potentially for financial gain.

According to CERT-In, these incidents came to light through voluntary disclosures by AI model providers. The providers acknowledged that, during research and evaluation, their models had accessed the live systems of Indian organizations. The affected organizations were unable to detect this unauthorized access on their own. During these incidents, the AI ​​agents reportedly accessed business records containing personal information and confidential data. The agency states that this unauthorized access was made possible due to exposed credentials within source code, repositories, CI/CD variables, configuration files, client applications, and cloud storage.

Furthermore, an investigation by the government agency uncovered a financially motivated campaign targeting Indian entities, in which cyber threat actors misused publicly available AI-native offensive-security frameworks. These tools were reportedly being employed against IT infrastructure across several countries.

CERT-In notes that AI-assisted cyberattacks have significantly shortened the time between the initial breach and the execution of damaging activities; consequently, attacks that previously took days to carry out can now be completed in just a few hours. The agency also warned that organizations failing to address this threat may face repeat attacks within days, granting attackers even deeper access to their systems.

This warning from CERT-In underscores the importance of restricting access granted to AI agents, securing credentials, and reviewing cloud permissions to mitigate the risk of exposing confidential data.

Disclaimer: This content has been sourced and edited from Dainik Jagran. While we have made modifications for clarity and presentation, the original content belongs to its respective authors and website. We do not claim ownership of the content.