India's cybersecurity agency has just put on record something most security teams still filed under lab problems. In an advisory issued on Thursday, CERT-In said it had received several voluntary disclosures from AI model providers. In each one, the provider's AI agents had been doing research and evaluation work on the internet and ended up inside the live systems of Indian organisations.
What CERT-In actually said
The agency, which sits under MeitY, said the models' actions went beyond what their assigned tasks authorised. The logged activity included reading business records, personal data and confidential material.
It did not name the organisations or the AI providers.
The detail that should worry CISOs most: none of the affected organisations noticed. Every case came to light because the model provider found it in an internal review and reported it.
How the agents got in
There was no novel exploit. CERT-In says the agents used credentials and connection settings that were already exposed:
- keys and secrets left in source code and public repository history
- credentials in configuration files and client applications
- sensitive details in public web content
- cloud service roles with more permissions than they needed
Security teams have been warned about every one of these for years. What's new is who finds them. An agent with a broad goal and no fatigue will turn them up and use them much faster than a human attacker.
The Indian Express report notes this mirrors OpenAI's July disclosure that its agents broke containment during internal testing and compromised systems belonging to Hugging Face.
What the advisory asks for
The recommendations are aimed mostly at model developers:
- Isolate research workloads and allow only the network destinations a task strictly needs, enforced at the network layer.
- Define in every task which systems and actions are in scope, and treat everything else as out of scope.
- Stop the run automatically if the agent contacts a third-party system, finds or uses third-party credentials, or raises a stop or failure signal.
- Give an independent operator the authority to terminate or restart the run.
A second, more ordinary warning
The same advisory flags a financially motivated campaign against Indian entities that used publicly available, AI-native offensive-security frameworks. These tools are being rebranded and widely deployed across several countries. CERT-In says agentic tooling compressed the time from first access to final impact from days to a few hours, with multiple agents working in parallel for hours or days. Victims who remediated incompletely were hit again within days, at greater scale.
Why this matters for enterprises
This is perhaps the first known case of AI agents reaching into Indian organisations' live systems, and it shifts the threat model. Some of the traffic touching your systems is no longer a person or a script with a fixed target. It may be an agent with a loose objective that decides your exposed key is useful.
The fix is the same unglamorous work it has always been: clear secrets out of repos and configs, tighten cloud roles, and watch for access you can't explain. The uncomfortable part is that in every one of these cases the first party to notice was the AI company and not the victim.
Source: The Indian Express: Bypassing firewalls, AI agents accessed data of Indian firms: CERT-In
