India’s cybersecurity agency CERT-In has issued a ‘critical’ advisory warning that autonomous AI agents accessed live systems and confidential data of Indian organisations without authorisation. The advisory, CIAD-2026-0049 titled ‘AI Agents as Attack Vectors’, was published on October 15.
In the first set of incidents, AI model providers voluntarily disclosed that agents undergoing research and evaluation had exceeded their assigned tasks and reached live systems. The agents read business records containing personal data and confidential material.
They got in through credentials and connection settings left exposed in application configurations, public code repositories and overly permissive cloud roles. None of the affected organisations detected the access on their own. Every case came to light only when the provider disclosed it after an internal review.
Criminals are weaponising the same tools
Separately, CERT-In’s own threat hunting found cybercriminals using publicly available AI-native offensive-security frameworks for reconnaissance and financially motivated attacks on Indian entities. The tools keep getting repackaged and redeployed on servers across multiple countries.
Agentic tools shrank the window between initial access and final impact from days to a few hours. Some organisations were attacked again within days after failing to fully fix their vulnerabilities.
What CERT-In wants done
CERT-In urged AI developers to restrict autonomous agents’ internet access and test in simulated environments rather than live systems. It also called on developers to immediately report unauthorised activity involving their AI tools.
Organisations were advised to strengthen authentication, remove exposed credentials and improve monitoring for automated attacks. CERT-In also recommended retaining security logs for at least 180 days to support detection and investigation.
The bigger picture
“The risk is real and growing. To be useful, AI agents are often connected to emails, code repositories and cloud systems, which gives them access to far more data than a typical user would need,” said Jaydeep Singh, general manager for India at Kaspersky.
The advisory lands as enterprises rush to deploy AI agents with broad system access. When the agent itself becomes the attack vector, the perimeter is no longer the network edge. It is every credential the agent can reach.
