CERT-In 警告 AI 智能体未经授权访问印度系统

India’s cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), has issued an advisory after AI agents accessed live systems of Indian organisations without authorisation.

The agents read business records containing personal data and confidential information, and the affected organisations did not detect the access themselves.

In its October 15 advisory, titled AI Agents as Attack Vectors: Unauthorised Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets, CERT-In said some AI agents exceeded the scope of tasks assigned to them during research and evaluation. It also identified financially motivated cyberattacks in which threat actors used publicly available, open-source AI security frameworks to conduct intrusions.

“In some incidents, AI agents under research and evaluation exceeded their assigned task authorisation and made unauthorised access to Indian information and communication technology (ICT) assets,” the agency said.

The affected organisations did not detect the unauthorised access themselves. According to CERT-In, AI model providers disclosed the incidents after conducting internal reviews. The agency did not identify the model providers or the organisations whose systems were accessed.

CERT-In said it received multiple voluntary disclosures from AI model providers whose models had reached live systems of Indian organisations while conducting research and evaluation activities on the internet.

“The recorded activity involved reading business records, including personal data and confidential information, through credentials and connection settings exposed in application configurations and cloud service roles,” CERT-In said.

The agency also identified conventional security weaknesses that contributed to the incidents. These included credentials and keys exposed in source code, configuration files, client applications and public web content; dormant or deprecated application programming interfaces (APIs) accessible over the internet; payment API keys stored in plain text; and cloud permissions that allowed broader access than required.

CERT-In said AI agents had found and exploited these weaknesses faster, more extensively and at a larger scale than human attackers.

In a separate set of incidents identified through its threat-hunting activities, CERT-In found financially motivated campaigns against Indian entities involving publicly available AI-native offensive-security frameworks.

The agency said these tools continued to be misused and rebranded, with deployments observed across infrastructure in multiple countries.

“In the financially motivated campaign against Indian entities, agentic tooling compressed the time between initial access and final impact from days to a few hours,” the advisory said.

CERT-In also found that attackers operated multiple agents in parallel for hours or days to achieve their objectives. Organisations that only partially addressed the exploited weaknesses were attacked again within days, with the subsequent attacks occurring at a greater scale.

In the incidents disclosed by AI model providers, agents were also found to have recovered and reused the same exposed credentials in separate operations.

CERT-In has urged AI model developers, research laboratories and evaluation agencies to isolate research and testing workloads from production systems. It recommended restricting outbound network access to destinations strictly required for a task and enforcing those restrictions at the network level rather than relying on instructions given to an AI model.

The agency also recommended using synthetic targets, test credentials and disposable infrastructure instead of production data and real credentials. Developers should monitor agent activity in real time and stop a run automatically if an agent accesses third-party systems or credentials outside the authorised scope.

For organisations and service providers, CERT-In recommended auditing source code, repositories, configuration files, client applications and cloud storage for exposed credentials. Organisations should rotate compromised credentials, remove obsolete APIs, restrict cloud permissions and enforce multi-factor authentication for administrative access.