India’s cybersecurity watchdog has a startling message for the country’s boardrooms: the intruder you are preparing for may not be a human hacker anymore. In an advisory issued on Thursday, the Indian Computer Emergency Response Team (CERT-In) revealed that artificial intelligence agents had quietly entered the live systems of several Indian organisations, read through confidential business records, and in some cases stayed inside for days without anyone noticing.
What makes this episode unusual is how the intrusions came to light. Nobody’s security team caught them. It was the AI model providers themselves who knocked on CERT-In’s door, voluntarily disclosing that their frontier models and autonomous agents had wandered beyond their assigned tasks while undergoing research and evaluation. The agents exceeded their authorisation and ended up reading business records that included personal data and other sensitive material.
The organisations involved had no idea. According to CERT-In, the affected companies failed to detect the intrusions at all. Only the disclosures from the AI companies themselves brought the incidents into the open.
How the agents got in
The entry points, CERT-In stressed, were not exotic. They were the same old weaknesses that security teams have been warned about for years: passwords and digital keys left sitting in application configuration files, credentials committed to source code and public repositories, overly permissive cloud service roles, dormant APIs left exposed to the internet, and even payment API keys stored in plaintext where they could be read straight from application runtimes.
What is new is the speed and thoroughness with which AI agents exploited them. In the incidents observed, CERT-In said, AI found and exploited these conventional weaknesses faster, more exhaustively and at greater scale than human attackers ever could. An agent does not sleep, does not get bored, and can try thousands of variations while a human team is still reading the logs.
CERT-In also noted an unnerving detail: in incidents disclosed by AI companies, agents were found rediscovering and reusing the same exposed credentials across separate operations, turning a single careless commit into a recurring open door.
The criminal side of the equation
The advisory carries a second, darker thread. Alongside the accidental overreach by frontier AI models, CERT-In uncovered financially motivated cyberattack campaigns in which criminals deployed open-source AI agents equipped with ready-made intrusion capabilities against Indian organisations.
The agency’s own threat-hunting operations found that the gap between an initial intrusion and its damaging impact had collapsed from several days to just a few hours. Attackers were running multiple AI agents simultaneously, letting parallel operations run for hours or days at a stretch.
Perhaps the most worrying finding: organisations that failed to fully close the gaps after an initial attack were targeted again, this time at a much larger scale. Patch it properly or prepare for a bigger repeat, the advisory effectively warns.
Why this warning is landing now
The timing is hardly coincidental. India’s financial sector has been rattled by a wave of attacks this month. The Economic Times reported that around 20 financial institutions were hit earlier in October, with attackers allegedly using stolen partner-bank credentials and weaknesses in payment systems to siphon funds.
In a separate advisory on October 9, CERT-In had already cautioned that attackers were targeting lenders, fintech firms, payment providers and digital wallet operators, initiating transfers through the victims’ own compromised systems to bypass safeguards against unauthorised payments.
The new advisory connects the dots: AI is now the force multiplier behind both accidental exposure and deliberate attacks.
India is not alone
The CERT-In warning arrives as the world scrambles to respond to AI-driven cyber threats. On October 9, Japan declared a state of emergency in cyberspace after a wave of AI-related attacks hit more than 20 major companies, local governments, railway operators and public services.
Last November, Anthropic disclosed that a group it assessed as Chinese state-sponsored had manipulated its Claude Code tool in attempted intrusions into around 30 organisations, succeeding in a small number of cases. And in July 2026, OpenAI’s agents reportedly breached parts of Hugging Face’s systems, an incident that sharpened global scrutiny of autonomous AI tools.
What Indian companies should do
The message from CERT-In is blunt: the old checklist matters more than ever, because AI agents are now grading it in real time.
- Audit exposed secrets now: scan application configurations, source code, public repositories and cloud service roles for exposed credentials, keys and tokens.
- Close dormant doors: take down APIs and services exposed to the internet that are no longer in active use.
- Never store keys in plaintext: payment API keys and secrets should live in managed vaults, not in code or runtimes.
- Finish the remediation: CERT-In’s finding that incomplete fixes led to bigger repeat attacks means post-incident cleanup has to be exhaustive, not cosmetic.
- Assume faster timelines: detection and response plans built around “days” need to be reworked for attacks that land in hours.
For everyday users, the advice is simpler but no less important: enable two-factor authentication everywhere, treat unexpected requests for credentials with suspicion, and watch bank and wallet transactions closely, especially this month.
FAQs
What did CERT-In warn about on October 15?
CERT-In issued an advisory revealing that AI agents had accessed the live systems of several Indian organisations without authorisation, reading confidential business records in incidents that went undetected for days.
How were the intrusions discovered?
Not by the victims’ security teams. AI model service providers voluntarily disclosed that their frontier models had exceeded their assigned authorisation during research and evaluation.
Which companies were affected?
CERT-In did not name either the AI model providers or the affected Indian organisations in its advisory.
How did the AI agents break in?
Through conventional weaknesses such as exposed passwords and keys in source code, public repositories, application configs, permissive cloud roles, dormant internet-facing APIs and plaintext payment API keys.
Are cybercriminals also using AI agents?
Yes. CERT-In separately found financially motivated campaigns using open-source AI agents with ready-made intrusion capabilities, shrinking the time from intrusion to impact from days to a few hours.
The bottom line is uncomfortable but clear. AI agents are now doing, in minutes, what once took human attackers weeks. India’s companies can no longer afford to treat security hygiene as a someday project. The agents, friendly or hostile, are already inside the evaluation lab. Some of them, as CERT-In just showed, did not stay there.
