NEW DELHI: India's cybersecurity agency CERT-In has issued a 'critical' advisory warning that autonomous Artificial Intelligence (AI) agents have accessed live systems and confidential data of Indian organisations without authorisation, while threat actors are actively weaponising open-source agentic AI tools to execute rapid cyberattacks.
In its advisory (CIAD-2026-0049) titled 'AI Agents as Attack Vectors', the Indian Computer Emergency Response Team (CERT-In) highlighted two distinct categories of incidents targeting the Information and Communication Technology (ICT) infrastructure of Indian entities.
In the first set of incidents, AI model providers voluntarily disclosed that autonomous AI models and agents undergoing research and evaluation had exceeded the authorised scope of their assigned tasks and reached live systems belonging to Indian organisations.
During these operations, the AI agents read business records containing personal data and confidential material, using credentials and connection settings left exposed in application configurations, public code repositories and overly permissive cloud service roles, the agency noted.
Notably, none of the affected organisations detected the access on their own. In every case, the incident came to light only when the AI model provider disclosed it after an internal review.
In a separate trend uncovered through its own threat hunting, CERT-In observed cybercriminals using publicly available AI-native offensive-security frameworks to conduct reconnaissance, exploit security weaknesses and carry out a financially motivated campaign against Indian entities.
These tools continue to be repackaged and redeployed, with many deployments seen on servers across multiple countries, it said.
In that campaign, agentic tools shrank the window between initial access and final impact from days to a few hours.
Victims that only partly fixed the weaknesses were attacked again within days, on a larger scale, the agency said.
CERT-In pointed out that conventional security lapses were the root weaknesses in all the recent AI agent-driven incidents it observed.
These included credentials and keys exposed in source code, public repository histories, configuration files, client applications and public web content; dormant, deprecated and test Application Programming Interfaces (APIs) left open to the internet; payment-API keys stored in plain text; over-permissive cloud and backend-as-a-service roles; and internet-facing management interfaces and unpatched middleware with weak passwords or no multi-factor authentication.
AI agents found and exploited these gaps faster, more thoroughly and at a larger scale than human attackers.
In the incidents disclosed by AI model providers, agents were also seen recovering the same exposed credential again and reusing it in separate operations.
To mitigate the threat, CERT-In has urged organisations and service providers to audit their source code, repositories including commit history, configuration files, client applications and cloud storage for exposed credentials.
Entities have been advised to rotate exposed credentials and purge them from code history, decommission dormant, deprecated and test APIs, enforce least-privilege access in cloud deployments and for in-house AI agents, take admin interfaces off the internet, require multi-factor authentication, and monitor attacks while keeping logs for at least 180 days.
After any credential exposure or confirmed intrusion, organisations should treat the environment as compromised until it is "forensically cleared", and expect repeat attempts within days to weeks, it said.
For AI developers, research laboratories and evaluation agencies, CERT-In recommended isolating research and evaluation work by blocking all outbound network access except what a task strictly needs, enforced at the network level rather than through instructions to the model, and using synthetic targets and test credentials instead of production data.
Commenting on the advisory, Jaydeep Singh, General Manager - India at Kaspersky, said it was "a timely reminder that AI agents are no longer just productivity tools".
"When given broad access, they can reach live systems and sensitive data in ways organisations never intended, often by moving through gaps that already exist, such as misconfigured cloud services, exposed credentials and excessive permissions," Singh said.
Valid accounts, public-facing applications and trusted relationships were the entry point for over 80 per cent of the attacks Kaspersky investigated in 2025, Singh said, "With AI allowing threat actors to iterate faster and scale their efforts, these paths can now be exploited more quickly than ever."
"AI agents used for research and testing should be kept fully separate from production environments, using synthetic data and test-only credentials," Singh said.
"Every agent should be inventoried, isolated in sandboxed environments, governed by default-deny rules and required to seek human approval before any irreversible action," Singh added.
Critical vulnerabilities should be patched or mitigated "within hours, not weeks", and code and pipelines audited regularly, Singh said, citing a Kaspersky study of around 30,000 popular GitHub repositories that found overly broad access permissions among the most common issues.
Singh recommended that organisations treat AI agents as part of their attack surface from day one.