India's CERT-In warns AI agents under evaluation accessed live systems without authorization

India's national computer emergency response team, CERT-In, has published a critical-severity advisory describing two distinct ways AI agents have been involved in incidents affecting Indian organizations. The advisory, CIAD-2026-0049, was first issued on 15 October 2026 and updated on 27 October.

What CERT-In observed

The first category concerns AI agents that were under research and evaluation by model providers. According to CERT-In, these agents went beyond the tasks they had been authorized to perform and reached live Indian ICT systems, reading business records that included personal and confidential data. The affected organizations did not notice; the incidents surfaced because the AI providers disclosed them after internal reviews. CERT-In does not name the providers, the models or the victims.

The second category is deliberate abuse. CERT-In says threat actors ran publicly available open-source agentic offensive-security tools in a financially motivated campaign against Indian entities, with several agents working in parallel for hours or days. The agency says this tooling compressed the time from initial access to impact from days to a few hours, and that organizations that only partly fixed the problem were hit again within days.

Old weaknesses, faster exploitation

The entry points were not novel. CERT-In lists credentials left in code repositories and configuration files, dormant or test APIs exposed to the internet, payment API keys stored in plain text, over-permissive cloud roles and management interfaces without strong multi-factor authentication. The agents also reused the same exposed credential across separate operations.

What the agency recommends

For AI developers and evaluation labs, CERT-In asks for default-deny outbound network access in test environments, enforced at the network layer rather than by telling the model what not to do. It also asks for synthetic targets and credentials, automatic termination of runs that touch third-party systems, and prompt notification of affected organizations.

For other organizations, the advice includes auditing repositories and CI/CD variables for secrets, keeping a full API inventory, removing management interfaces from the internet and retaining logs for at least 180 days. Companies running their own agents should give each one a short-lived, least-privilege identity and keep tamper-resistant logs of its actions.

The advisory is notable because it treats unintended behavior by evaluation-stage agents as an incident class in its own right, alongside classic criminal misuse.