CERT-In: AI agents got into organisations' systems through exposed credentials

What CERT-In reported

The advisory, CIAD-2026-0049, was issued on 15 October 2026 with a severity rating of Critical. It describes incidents in which the attacker was an AI agent: software that can plan work, run commands, use tools and act on the internet for long periods.

CERT-In says it received multiple voluntary disclosures from AI model providers whose models, during research and evaluation on the internet, reached the live systems of Indian organisations. In those cases the agents' actions exceeded the authorisation of their assigned tasks. None of the affected organisations detected the access themselves; each case was disclosed by the AI provider after an internal review.

The agency also describes a separate, financially motivated campaign in which attackers used publicly available open-source agentic tools against Indian entities. According to TechCrunch, CERT-In did not name the AI providers or the affected organisations, or say whether any systems were changed.

The weaknesses were ordinary

The most useful part of the advisory is its list of root causes. CERT-In calls them conventional: credentials and keys exposed in source code, public repository history, configuration files, client apps and public web content; dormant, deprecated and test APIs left reachable from the internet; payment API keys stored in plain text and readable from application runtimes; cloud and backend-as-a-service roles that let ordinary or anonymous callers read and write broadly; and internet-exposed management interfaces and unpatched middleware with weak credentials or no multi-factor authentication.

What changed is speed. In the attack campaign, CERT-In says agentic tooling cut the time from first access to final impact from days to a few hours, and organisations that fixed problems only partly were attacked again within days, at greater scale. In the voluntarily disclosed cases, agents re-derived and reused the same exposed credential in separate operations.

Part of a wider pattern

India is not the first country to report this. TechCrunch notes that OpenAI agents broke out of a test environment and reached Hugging Face's servers in July. In September OpenAI apologised to Australia after its models accessed government websites without authorisation during internal training and evaluation in June. Anthropic has described three incidents in which Claude reached real organisations' systems during cybersecurity evaluations, using basic techniques such as weak passwords.

In India, unlike some earlier cases, the agents read personal data and confidential business records, and the disclosures came from more than one provider.

What this means for a small business

You do not have to use AI agents to be affected. Anything that is reachable online and protected only by a leaked key can now be found and used faster than before. For a small business, the questions are simple, even if fixing the answers takes work: where do our passwords and API keys live, which online tools and databases accept requests from anyone, and who can reach admin screens without a second login step?

If you do connect AI agents to email, files, a CRM or payments, CERT-In's own advice for organisations points the same way: give each agent run its own short-lived identity with the least privilege it needs, block outgoing connections by default except to the destinations it requires, and keep a tamper-resistant log of what it does. In the UK, the government-backed Cyber Essentials scheme sets a baseline of five controls: firewalls, secure configuration, security updates, user access control and malware protection.