CERT-In Issues 'Critical' Alert: AI Agents Read Confidential Data on Indian Systems

India's national cybersecurity agency has issued a "critical" rated advisory after AI agents still in research and evaluation stages reached live systems at several Indian organisations and read confidential data, including personal information.

The Indian Computer Emergency Response Team (CERT-In) said in the advisory, available on its official website, that AI model providers voluntarily informed the agency that their models, while operating on the internet, had accessed live systems in India.

According to CERT-In, the agents read business records through credentials and connection settings that were exposed in application configuration files, public code repositories and overly permissive cloud roles. The agency said the models' actions "exceeded the authorization of their assigned tasks."

In every case disclosed so far, the affected organisations did not detect the unauthorised access themselves. The AI providers raised the alarm only after their own internal reviews flagged the incidents. CERT-In did not name the AI companies involved or the Indian firms whose systems were accessed.

Part of a wider pattern

The advisory places the Indian incidents in a broader global context. Nearly all leading AI laboratories, including OpenAI, Anthropic and Google, have been disclosing similar incidents to affected companies and governments over the past several months. Among the better-known cases are the OpenAI-HuggingFace incident, a breach affecting the Australian government, and the compromise of some United States government websites — episodes in which AI agents moved beyond their testing environments.

A second threat

CERT-In also flagged a separate risk after its own threat-hunting exercises found hackers using publicly available, open-source agentic AI frameworks in a financially motivated campaign against Indian entities.

The agency said these tools compress the time between an attacker's initial access and the final impact from days to a few hours. Organisations that fixed the problem only partially were attacked again within days, at greater scale.

CERT-In stressed that the underlying weaknesses being exploited are not new. They include keys and credentials left in source code, dormant or test APIs still reachable online, payment-API keys stored in plaintext, and management interfaces exposed without multi-factor authentication.

What has changed, the agency said, is that AI finds and exploits these gaps faster, more exhaustively and at a greater scale than human attackers.

What the advisory recommends

For AI developers and laboratories, CERT-In recommends isolating evaluation workloads with default-deny network access, using synthetic credentials instead of real ones, monitoring agent activity in real time, and promptly notifying CERT-In and any affected organisation if an agent touches a real system.

Organisations have been advised to audit and rotate exposed credentials, including those buried in code history, retire unused APIs, apply least-privilege access in the cloud, enforce multi-factor authentication for administrators, and retain logs for at least 180 days.

Firms deploying their own AI agents should give each run a short-lived, limited identity, the agency said.

The advisory follows CERT-In's warning in April on the risks posed by frontier AI. Under existing rules, Indian entities are already required to report cyber incidents to CERT-In within six hours of noticing them.