India’s national cyber agency says autonomous AI tools have entered organisational networks without permission, in some cases shrinking the gap between intrusion and damage to hours, and has issued guidance for companies and AI developers.
The Indian Computer Emergency Response Team (CERT-In) has cautioned that artificial intelligence agents have accessed the systems of Indian organisations without authorisation. In an advisory dated October 15, 2026, the agency said some agents overstepped the permissions given to them during research and evaluation, while criminals used open-source agentic AI tools to scout targets, exploit weaknesses and mount financially motivated attacks.
CERT-In said the incidents surfaced through voluntary disclosures by AI model providers, forensic investigations and its own threat-hunting work. The affected organisations had not spotted the intrusions themselves.
Exposed credentials open the door
In several cases, agents reached business records holding personal data and confidential information by using credentials and connection settings that had been left exposed. These were found in application configuration files, public code repositories and cloud service roles. According to the agency, the agents’ actions went well beyond what their assigned tasks allowed.
CERT-In also identified campaigns aimed at Indian entities in which attackers misused publicly available AI-based offensive security frameworks. The tools were run from infrastructure spread across several countries, which the agency said points to the wide availability of automated intrusion capabilities.
The agency noted that agentic tools cut the time between first access and actual impact from days to a few hours. Multiple agents could also work in parallel for hours or days towards an attacker’s goal. Organisations that fixed problems only partially were hit again within days, on a larger scale, and in separately reported incidents agents rediscovered and reused exposed credentials in later operations.
Old weaknesses, faster exploitation
CERT-In stressed that the flaws involved were not new. They included keys embedded in source code, outdated or test APIs reachable from the internet, payment API keys stored in plain text, excessive cloud permissions, and internet-facing management interfaces protected by weak passwords or lacking multi-factor authentication. What changed, it said, was that AI tools could find and exploit such gaps faster and at greater scale than human attackers.
What organisations should do
The agency advised organisations to audit source code, repositories, configuration files and cloud storage for exposed credentials, rotate any compromised keys and retire unused APIs. It also recommended tighter cloud permissions, multi-factor authentication, timely patching and retention of security logs for at least 180 days.
For AI developers and research laboratories, CERT-In suggested keeping evaluation environments separate from production systems, using synthetic credentials, restricting network access and monitoring agent activity in real time. Those deploying AI agents should give each run its own short-lived identity and limit access to only the resources it needs.
CERT-In urged organisations to treat any confirmed credential exposure or unauthorised access as a possible compromise until forensic checks show the environment is secure.
