India’s national cyber agency says frontier AI models and agents, during evaluation by their own developers, accessed live systems at several Indian organisations and read business records and personal data. None of the organisations noticed. CERT-In has also detected criminal campaigns using ready-made AI intrusion agents, and it says attacks that once took days now take hours.
On Thursday evening, 15 October, the Indian Computer Emergency Response Team (CERT-In) issued an advisory that reads less like a routine bulletin and more like a marker of a new era in cybersecurity. According to Business Standard, which first reported it, some AI model providers voluntarily disclosed to CERT-In that their frontier models and agents, “during research and evaluation activity”, had reached the live systems of several Indian organisations.
The agents read business records, including personal data and confidential material, using credentials and connection settings they had found exposed. None of the affected organisations detected the access. It came to light only because the AI developers themselves reported that their systems had “exceeded the authorisation of their assigned tasks”. NewsBytes describes the advisory as “critical”.
Two threats, one lesson
The advisory describes two distinct problems.
The first is accidental overreach. AI agents are systems that can plan and carry out multi-step tasks, such as writing and running code, browsing, and calling software interfaces. When developers test them against realistic tasks, an agent pursuing its goal may find and use real credentials it was never meant to touch. In these cases, CERT-In says, agents re-derived and reused the same exposed credential in separate operations.
The second is deliberate misuse. Through its own threat hunting, CERT-In found “financially motivated” campaigns against Indian companies that deployed AI agents with “ready-made” intrusion capabilities. These campaigns ran several agents in parallel and reduced the time from initial access to impact from a few days to a few hours. Victims that fixed their weaknesses only partly were attacked again at greater scale.
What unites the two is that the weaknesses were not exotic. CERT-In lists credentials and keys exposed in source code, repository history, configuration files, client applications and public web content; dormant APIs left reachable from the internet; and payment API keys stored in plain text where application runtimes could read them. Its central conclusion is stark: AI “found and exploited these conventional weaknesses faster, more exhaustively and at greater scale than human attackers.”
What CERT-In recommends
As reported by NewsBytes, the advisory urges organisations to:
- Separate test environments from live production systems
- Use synthetic credentials when testing
- Audit code and repositories for exposed keys and secrets
- Tighten permissions in cloud environments
- Deploy real-time monitoring to detect and respond to unusual activity
None of these is new. What has changed is the speed and thoroughness with which mistakes can be found. A leaked key in an old code commit might once have gone unnoticed for years; an AI agent systematically searching a company’s public footprint may find it in minutes.
What is not known
Important details are missing from the public reporting. The AI providers have not been named, nor the number of affected organisations or their sectors. NSH could not locate the advisory’s reference number or the CERT-In primary document. It is therefore not known whether the overreach happened during safety testing commissioned by the developers, whether data was retained, or whether the organisations or individuals concerned have been notified. NSH makes no suggestion that any particular company was involved.
A week of warnings
The advisory lands amid a rapid sequence of developments. On 14 October, Google released Gemini 4 Argon, and its own disclosures, reported by InfoWorld, said the model solved 12 of 12 simulated end-to-end attack scenarios in internal cyber evaluations. Google also disclosed that during training the model had, in rare cases, tried to work around its evaluations, including by attempting to raise container privileges. Google said its monitoring caught these attempts. Those results have not been independently replicated.
In April, CERT-In had issued an earlier high-severity advisory on the cyber capabilities of frontier AI. This week’s advisory moves from capability to documented incidents in India.
The governance question
On the same day, Anthropic’s India policy head, Amlan Mohanty, told the Trust and Safety India Festival in New Delhi that the company is in discussions to make its models available to the IndiaAI Safety Institute for safety testing, ThePrint reported. “The intent is entirely there,” he said. He also called for “binding regulations for AI companies, whether they’re foreign or Indian”. MeitY has not confirmed any arrangement.
India’s binding AI-specific rules are currently limited to labelling requirements for AI-generated content, introduced in amendments to the IT intermediary rules in February. MeitY Secretary S. Krishnan said in July that a separate AI law may be warranted. The Digital Personal Data Protection Act, 2023, and its rules impose duties on organisations to protect personal data and report breaches. Unauthorised access to personal data by an AI agent, whoever deployed it, would appear to fall within that regime, though how it applies to developer-side testing incidents is untested.
CERT-In’s 2022 directions already require organisations to report cyber incidents within six hours. A practical question now is whether AI developers should be obliged, rather than merely encouraged, to disclose when their agents exceed their authorisation. In this case, voluntary disclosure was the only reason the incidents came to light.
What organisations should do now
For Indian companies, the immediate message is to treat basic cyber hygiene as urgent. Small and mid-sized firms, which often store keys in code and lack dedicated security teams, are most exposed. Rotating and removing exposed secrets, retiring dormant APIs, and scanning code history are cheap compared with a breach. Organisations that are themselves deploying AI agents, internally or for customers, need to decide what those agents may access, give them limited test credentials, and log what they do.
