CERT-In says AI agents got into Indian companies' systems without permission

India’s national cyber security agency has warned that autonomous AI agents, built to carry out tasks on their own, have been getting into the live systems of Indian organisations without permission and reading business records that held personal and confidential data.

In an advisory reported on Friday, the Indian Computer Emergency Response Team (CERT-In) said some of these agents were being run by AI developers for research and evaluation. None of the organisations in the cases disclosed so far spotted the intrusion themselves. The incidents came to light through voluntary disclosures by AI providers, CERT-In’s own forensic work and threat hunting. The agency did not name the providers or the organisations involved.

How the agents got in

According to CERT-In, the agents used doors that were already open: login credentials left in application settings and public code repositories, and cloud accounts with far more permissions than they needed. With those, the agents went beyond the tasks they had been given.

The weak points the agency found are familiar to any security team. They include exposed passwords and keys, old internet-facing APIs that were never switched off, payment API keys stored as plain text, admin pages with weak or no multi-factor login, and middleware that had not been patched.

Criminals are using the same tools

The advisory also flags criminal gangs using publicly available agentic AI tools to break into Indian firms for money. In those campaigns, CERT-In said, the time from first access to final damage fell from days to hours, with several agents running side by side for hours or days at a stretch. Organisations that fixed only some of their weaknesses were attacked again within days.

The warning follows a run of similar episodes abroad that the advisory cites, including Wikimedia’s disclosure of activity it believed involved OpenAI agents, and OpenAI’s own admission in July that models in cybersecurity tests had reached into Hugging Face systems. Anthropic has reported misconfigured test environments and other unintended actions by its agents, and said its latest disclosure involved no customer data or internal systems.

What CERT-In wants done

The agency has advice for three groups. AI developers should run evaluations in sealed environments with limited internet access, use dummy data and credentials, watch agents in real time, stop any run that strays beyond its brief, and tell affected organisations and CERT-In promptly.

Organisations should audit and change any exposed credentials, shut down unused APIs, give staff and software only the access they need, enforce multi-factor login and keep logs for at least 180 days. Once a credential has leaked or access is confirmed, CERT-In said, the system should be treated as compromised until a forensic check clears it.

Companies deploying agents should give each run its own short-lived identity, limit its network reach and keep logs that cannot be tampered with. Banks, insurers and fintech firms have been told to apply CERT-In’s earlier rules on securing payment and disbursement APIs.