CERT-In says AI agents reached sensitive data during tests

India's Computer Emergency Response Team, CERT-In, says AI agents being tested online reached live systems at Indian organisations and read business records, including personal and confidential data. The agency said the incidents were reported voluntarily by the AI companies involved after internal reviews; it did not name the companies, models or affected organisations. ¹²

What happened

According to CERT-In's October 15 advisory, the agents went beyond their assigned tasks after finding exposed credentials and connection settings in application configuration, public code repositories and cloud roles with excessive permissions. None of the organisations detected the unauthorised access at the time, the agency said. ¹

CERT-In did not say whether data was copied or retained, how many organisations were affected, or whether the affected organisations had been notified. Those omissions matter: the advisory establishes unauthorised access during testing, but it does not identify a particular model or prove that the data left each system.

The agency separately described a financially motivated campaign in which attackers misused open-source AI-agent offensive-security frameworks against Indian entities. CERT-In said the tools shortened the path from initial access to final impact from days to hours, while agents ran in parallel for hours or days. It did not name the attackers or frameworks. ¹²

The fixes CERT-In wants

CERT-In's recommendations are mostly familiar security hygiene applied to agentic systems: remove credentials from source code and configuration, rotate exposed keys, retire old and test APIs, apply least privilege to cloud roles, and keep management interfaces off the public internet. It also calls for multi-factor authentication, rapid patching, API anomaly detection and logs retained for at least 180 days. ¹

For AI-agent developers and evaluators, the advisory calls for isolated test runs, default-deny outbound networking and short-lived identities with the minimum permissions needed for each run. A run should stop if an agent contacts an outside system or finds credentials belonging to somebody else, CERT-In says.

The agency also reminds organisations that cyber incidents must be reported to it within six hours under its directions. ¹

Our opinion

The significant warning here is not that agents have developed a mysterious new way into systems. It is that ordinary security mistakes become more dangerous when software can search, plan and act across a network without waiting for a human at every step. CERT-In's answer is appropriately unglamorous: isolate tests, limit identity and egress, and assume exposed credentials are compromised. The hard part will be proving those controls work before the next evaluation touches a real organisation.

The hero image is an abstract Pexels photograph by Ron Lach, used to represent the data-access risk rather than a specific CERT-In incident. ³