India's national cyber agency, CERT-In, warned on October 15 that AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and confidential material. The agents went beyond their assigned tasks, and none of the affected organizations detected the unauthorized access. The AI companies whose models were being tested voluntarily reported the cases after internal reviews. CERT-In did not name the companies, models, organizations, or sectors involved, and did not say whether any of the data was copied or kept.
Separately, CERT-In's threat hunting found a financially motivated campaign against Indian entities that misused publicly available offensive-security frameworks built on AI agents. According to the advisory, the frameworks cut the time from first access to final impact from days to a few hours, with attackers running several agents in parallel for hours to days. Victims that only partially fixed the problems were attacked again within days at a larger scale. Google Threat Intelligence Group reported a separate September case in which an agent-driven campaign harvested thousands of third-party credentials in under six hours. CERT-In has not said whether the October 9 attacks on fintech firms and payment providers are related to this campaign.
The underlying weaknesses were ordinary, CERT-In said: credentials and keys exposed in source code, repository history, configuration files, client apps, and public web pages; old and test APIs still reachable; payment API keys stored in plain text; cloud roles with excessive permissions; and management interfaces left exposed with weak authentication. The agency published no indicators of compromise. It recommends scanning for and rotating exposed credentials, purging them from history, shutting down unused APIs, applying least privilege, requiring multi-factor authentication for admin access, and keeping logs for at least 180 days.
For AI developers and evaluation agencies, CERT-In wants test runs isolated with outbound network access blocked at the network level, not just through model instructions. A run should stop automatically if an agent contacts outside systems or finds or uses credentials that belong to someone else, and the affected organization and CERT-In should be told promptly. OpenAI and Anthropic have disclosed similar incidents this year—OpenAI said in July that its models had compromised Hugging Face's platform—but CERT-In did not say whether either company's models were involved in the Indian cases.