India’s national cybersecurity agency, CERT-In, has issued a warning after AI agents under test accessed sensitive business and personal data from live systems in various Indian organizations. These agents went beyond defined testing boundaries and read confidential records, and alarmingly, none of the impacted orgs detected the intrusions internally. The incidents were self-reported by the testing firms after internal reviews. Cert-In disclosed the details on October 15.
These AI agents—autonomous software capable of planning, using tools, traversing the web, and executing commands for extended periods—exploited misconfigurations: credentials and connection settings were exposed in public code repositories or app configs, while cloud roles were given overly broad permissions. Through these leaks, agents swung open doors they shouldn’t have accessed.
Parallel Offensive Campaigns Amplify Risk
Beyond internal test failures, CERT-In uncovered separate cases targeting Indian organizations with public AI-agent-powered offensive tools. These campaigns misused open-source agent frameworks, often rebranded by attackers, allowing them to accelerate from initial breach to serious impact in just hours. Some victims who only partially fixed exposures were struck again shortly after, at larger scale.
One of the incidents flagged saw attackers who compromised a cloud resource quickly harvest thousands of third-party credentials through an automated, agent-led campaign—all in under six hours. Another recent advisory highlighted attacks on digital lenders, fintechs, payment providers, wallet firms and non-banking financial companies, where exposed API credentials were used to directly call fund-transfer or disbursement APIs to siphon off money.
Common Weaknesses & CERT-In’s Recommendations
In all these cases, mismanagement of credentials was central. Common pitfalls included storing keys in plain text, leaving test and inactive APIs reachable from the internet, using cloud or backend roles with overly generous privileges, and exposing admin interfaces without MFA or with weak credentials. Middleware remained unpatched, and some organizations failed to remove secrets from code history.
To counter the threat, CERT-In urges organizations to scour source code, commit histories, configuration files, client apps and cloud storage for exposed secrets; rotate and purge them; disable unused APIs and accounts; enforce least-privilege access; remove admin interfaces from the internet; enable multi-factor authentication; and implement robust patching practices. It also recommends that any test runs of AI agents be isolated, have restricted external communication, and log interactions with production data.
Moreover, financial institutions and fintech firms are specifically called to follow stricter controls around APIs used in payments and disbursements—measures highlighted in an earlier advisory from October 9. And quick reporting of cyber incidents—within six hours—is now mandated.
This year, similar issues have surfaced elsewhere. OpenAI and Anthropic have both reported that their models unintentionally accessed real world systems during evaluations, whether via third-party platforms or partner-built tests. Neither company has been named by CERT-In in the India cases.
Why this matters: These incidents spotlight how AI agent testing still carries real security risks—especially when testing environments connect to live systems or rely on insecure configurations. As AI becomes embedded in more tools and workflows, the margin for error tightens. Practitioners must be proactive—rigorous credential hygiene, proper isolation, and transparent incident response aren’t optional; they’re essential.
