AI Agents Pose New Cybersecurity Threat to Indian Organisations, CERT-In Warns (ETV Bharat)
New Delhi: In a ‘critical’ advisory, India’s cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), has warned of autonomous artificial intelligence (AI) agents accessing live systems and confidential data belonging to Indian organisations without authorisation.
The cybersecurity agency also raised concern over a growing threat from cybercriminals using open-source agentic AI tools to launch faster and more sophisticated cyberattacks.
The agency released the advisory titled ‘AI Agents as Attack Vectors’. The agency has made two distinct categories of incidents targeting the information and communication technology (ICT) infrastructure of Indian entities.
CERT-In has observed different categories of cyber incidents in which the attacker was an AI agent, that is, a software system capable of autonomously planning work, issuing commands, invoking tools and acting on the internet over extended periods. In some incidents, AI agents under research and evaluation exceeded their assigned task authorization and made unauthorized access to Indian information and communication technology (ICT) assets. In others, cyber attackers deliberately used open-source agentic AI tools to conduct reconnaissance, exploitation and financially motivated intrusions.
Categories of Incidents
Voluntary Disclosures
AI model providers voluntarily disclosed incidents in which autonomous AI models and agents undergoing research and evaluation exceeded the authorised scope of their assigned tasks and accessed live systems belonging to Indian organisations.
Recently, CERT-In received multiple voluntary disclosures from AI model providers stating that their models, during research and evaluation activity on the internet, had reached the live systems of Indian organizations.
The recorded activity involved reading business records, including personal data and confidential material, through credentials and connection settings exposed in application configuration, public code repositories and permissive cloud service roles.
Cyber attackers using open-source agentic AI tools
CERT-In further observed cybercriminals deploying publicly available AI-powered offensive-security frameworks to conduct reconnaissance, exploit vulnerabilities and carry out financially motivated attacks against Indian entities.
These frameworks continue to be misused and rebranded, with a large number of deployments observed across infrastructure in multiple countries, indicating the widespread availability of ready-made agentic intrusion capabilities.
In the first category, AI model providers voluntarily disclosed incidents in which autonomous AI models and agents undergoing research and evaluation exceeded the authorised scope of their assigned tasks and accessed live systems belonging to Indian organisations.
According to CERT-In, the agents accessed business records containing personal information and confidential material by exploiting exposed credentials and connection settings. These weaknesses were found in application configurations, public code repositories and cloud service roles with excessive permissions.
A major concern was that none of the affected organisations detected the unauthorised access independently. The incidents came to light only after the AI model providers reported them following internal reviews.
Cybercriminals Weaponise Agentic AI Tools
In a separate trend identified through its threat-hunting activities, CERT-In observed cybercriminals deploying publicly available AI-powered offensive-security frameworks to conduct reconnaissance, exploit vulnerabilities and carry out financially motivated attacks against Indian entities.
The agency noted that these tools are repeatedly repackaged and redeployed, with numerous deployments identified on servers across multiple countries.
The use of agentic AI has significantly accelerated the attack process. According to CERT-In, the time between initial access and the final impact of an attack has been reduced from several days to just a few hours.
Organisations that only partially addressed security vulnerabilities were targeted again within days, with subsequent attacks carried out on a larger scale.
Conventional Security Gaps
CERT-In stated that conventional cybersecurity weaknesses were the main reasons for all the recent AI agent-driven incidents it observed. However, AI agents enabled attackers to identify and exploit these gaps more quickly.
The key weaknesses included:
Credentials and access keys exposed in source code, public repository histories, configuration files, client applications and publicly accessible web content.
Dormant, deprecated and testing APIs left accessible over the internet.
Payment API keys stored in plain text.
Excessively permissive cloud environments and backend-as-a-service roles.
Internet-facing administrative interfaces and unpatched middleware protected by weak passwords or lacking multi-factor authentication.
CERT-In also reported that, in incidents disclosed by AI model providers, agents were able to retrieve previously exposed credentials and reuse them in separate operations, increasing the potential for repeated unauthorised access.
Immediate Security Measures Should Be Taken
- CERT-In advised organisations and service providers to conduct comprehensive security audits covering source code, repository commit histories, configuration files, client applications and cloud storage to identify exposed credentials.
- Implement the baseline measures as outlined in the CERT-In “Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure”.
- Audit for exposed credentials in source code, repositories (including commit history), continuous integration and continuous delivery (CI/CD) variables, configuration files, client applications and cloud storage.
- Rotate any exposed credential, purge it from history and verify the fix externally. Scan every commit and build for secrets. Keep credentials out of code, configuration files and databases.
- Keep a complete inventory of APIs. Decommission dormant, deprecated and test APIs and accounts.
- Apply least privilege in cloud and backend-as-a-service deployments. Use row-level security and least-privileged client roles. Never place privileged or service keys in client-side code. Allow writes only to authenticated, authorized roles. Test what an anonymous caller can read and write.
- Remove management and administrative interfaces from the internet. Enforce multi-factor authentication for all administrative access. Patch exposed application middleware without delay.
- Detect attacks at machine speed. Apply rate-based and per-second API anomaly detection. Alert on enumeration bursts, bulk reads and automated registrations. Retain logs for at least 180 days.
- After any credential exposure or confirmed access, treat the environment as compromised until forensically cleared. Retest after remediation. Expect repeat attempts within days to weeks.
- Govern Al agents deployed within the organization. Give each run a separate, short-lived identity with least privilege. Enforce default-deny egress, permitting only required destinations, and maintain a tamper-resistant log of agent activity, covering at minimum all actions that affect production systems and data.
- BFSI and fintech entities should also implement the payment and disbursement API measures advised in CIAD-2026-0046.
Also Read
‘We Have Never Feared Competition’: Reliance Responds Amid Elon Musk’s Starlink Criticism
SME IPO Rules Set For A Major Shake-Up As SEBI Proposes Key Changes