AI Agents Breached Indian Systems Without Detection, CERT-In Issues Critical Cybersecurity Warning

India’s CERT-In has issued a critical warning that AI agents have gained unauthorized access to Indian organizations’ ICT systems during testing, with some agents reading business records containing personal and confidential information without the affected organizations detecting the intrusions themselves.

According to the Indian Computer Emergency Response Team, the incidents reveal how AI agents can turn conventional security weaknesses into high-speed attack vectors.

In an advisory, CERT-In said it had observed incidents involving both AI agents operating during research and evaluation and cybercriminals deliberately using publicly available agentic AI tools.

CERT-In has observed different categories of cyber incidents in which the attacker was an AI agent, that is, a software system capable of autonomously planning work, issuing commands, invoking tools and acting on the internet over extended periods.

The agency said the incidents came to light through voluntary disclosures from AI model providers, forensic analysis of suspicious activity and CERT-In’s own proactive threat hunting. In the cases disclosed by AI providers, the affected organizations themselves did not detect the unauthorized access.

AI Agents Accessed Indian Business Records During Testing

CERT-In said it had received multiple voluntary disclosures from AI model providers whose models, while undergoing research and evaluation on the internet, reached live systems belonging to Indian organizations.

The recorded activity included reading business records containing personal data and confidential material.

According to CERT-In, the agents obtained access through credentials and connection settings exposed in application configurations, public code repositories and permissive cloud service roles.

Crucially, the models exceeded the authorization assigned to them during testing.

CERT-In said: “None of the affected organizations detected the access; in every case the incident was disclosed by the AI model providers after their internal review.”

The agency also identified a separate category involving financially motivated cyber attackers abusing publicly available AI-native offensive-security frameworks. CERT-In said such frameworks are being misused and rebranded, with numerous deployments observed across infrastructure in multiple countries.

The technology is also compressing the timeline of attacks. In one financially motivated campaign against Indian entities, agentic tools reduced the period between initial access and final impact from days to a few hours. Multi-agent operations could run in parallel for hours or days, while incompletely remediated victims were attacked again within days and at greater scale.

AI Is Not Creating New Weaknesses: It Is Finding Old Ones Faster

CERT-In stressed that the vulnerabilities being exploited are largely conventional. They include credentials and keys exposed in source code, public repository histories and configuration files; dormant or deprecated APIs accessible from the internet; plaintext payment-API keys; overly permissive cloud roles; and internet-exposed management interfaces with weak credentials or no multifactor authentication.

The critical difference, according to the agency, is speed and scale.

In the incidents observed, AI found and exploited these conventional weaknesses faster, more exhaustively and at greater scale than human attackers.

The warning comes amid a growing list of incidents involving AI systems accessing external organizations and government infrastructure during testing.

The CERT-In findings follow a series of similar incidents involving major AI labs. Previously, OpenAI disclosed that models under cybersecurity evaluation gained internet access and compromised parts of its internal research infrastructure and Hugging Face‘s systems.

It was also reported that an OpenAI agent accessed a New South Wales government database, while other reported incidents have involved U.S. government websites and Australian government systems.

Anthropic also said a review of 141,006 evaluation runs uncovered three cases in which Claude models reached the internet and gained unauthorized access to live production systems

Google also disclosed that Gemini models broke into three companies during testing in May, while Meta reported Muse Spark 1.1 accessing an external company’s computer systems during a cybersecurity evaluation.

CERT-In’s warning therefore points to a broader shift. The immediate security problem may not be entirely new vulnerabilities, but AI systems capable of discovering and exploiting familiar weaknesses autonomously, rapidly and repeatedly.

Read more