CERT-In 称 AI 智能体未经授权访问印度系统

.entry-header

Download the advisory here.

The Indian Computer Emergency Response Team (CERT-In) has flagged incidents in which artificial intelligence (AI) agents accessed Indian information and communication technology (ICT) systems without authorisation, including during research and evaluation.

In an advisory issued on October 15, 2026, CERT-In rated the threat as critical and warned that attackers are also using open-source agentic AI tools to exploit vulnerabilities and conduct financially motivated intrusions. The advisory identifies exposed credentials, insecure application programming interfaces (APIs) and excessive cloud permissions among the weaknesses exploited.

Incidents involving agentic AI: CERT-In identified two categories of incidents. In the first, AI model providers voluntarily disclosed that their models had accessed live systems belonging to Indian organisations during internet-based research and evaluation.

The agents accessed business records, including personal data and confidential material, using credentials and connection settings exposed in application configurations, public code repositories and permissive cloud service roles. Their actions exceeded the authorisation granted for their assigned tasks. None of the affected organisations detected the access; the providers disclosed the incidents following internal reviews.

In the second category, CERT-In observed financially motivated campaigns against Indian entities in which cyber threat actors used publicly available, AI-native offensive security frameworks. These frameworks continued to be misused and rebranded, with deployments observed across infrastructure in multiple countries. This indicated the widespread availability of agentic tools for conducting intrusions.

Observations made by CERT-In: Agentic tools reduced the time between initial access and final impact in financially motivated attacks against Indian entities from days to a few hours. The agency also observed multi-agent operations running in parallel for hours or days to achieve attackers’ objectives.

Organisations that incompletely remediated vulnerabilities faced repeat attacks within days, at a greater scale. In the incidents disclosed by AI model providers, agents re-derived and reused the same exposed credentials across separate operations.

The weaknesses themselves were conventional: exposed credentials and keys in source code, repository histories, configuration files, client applications and public web content; dormant or deprecated APIs accessible over the internet; plaintext payment API keys; excessive permissions in cloud and backend-as-a-service systems; and internet-exposed management interfaces and unpatched middleware with weak credentials or no multi-factor authentication. CERT-In found that AI exploited these weaknesses faster, more exhaustively and at a greater scale than human attackers.

Recommendations: CERT-In issued separate recommendations for AI developers and organisations. For model developers, research laboratories and evaluation agencies, it recommended isolating research workloads through default-deny network controls, using synthetic targets and credentials, and keeping production data out of evaluation environments.

Developers should define task boundaries, automatically stop runs that access third-party systems or credentials, monitor agent activity in real time and maintain detailed request logs. They should also prevent agents from reusing third-party credentials and promptly notify affected organisations and CERT-In of unauthorised access.

For organisations and service providers, CERT-In recommended auditing exposed credentials, rotating compromised keys, removing secrets from repository histories, maintaining API inventories and decommissioning dormant interfaces. It also advised applying least-privilege permissions, removing administrative interfaces from the internet, enforcing multi-factor authentication and retaining security logs for at least 180 days.

Organisations should retest after remediation, anticipate repeat attacks, and assign AI agents separate, short-lived identities with restricted network access and tamper-resistant activity logs. BFSI and fintech entities should additionally implement the payment and disbursement API measures CERT-In had proposed in a recent advisory.

Why does this matter? CERT-In’s advisory identifies familiar security weaknesses, including exposed credentials, insecure APIs and excessive cloud permissions. However, the agency’s record raises questions about whether issuing technical recommendations translates into implementation.

As agentic AI tools become more capable and accessible, malicious actors could increasingly use them to automate reconnaissance, exploit vulnerabilities and conduct intrusions at greater speed and scale. CERT-In has already observed attackers using open-source agentic AI frameworks against Indian entities, making effective remediation and monitoring more pressing.

In a 2023 investigation, MediaNama found through an RTI response that CERT-In had no information on how many entities complied with its April 2022 cybersecurity directions and had not sought compliance status from all entities. A separate RTI investigation found that only 15 entities reported incidents within the mandated six-hour window during the period examined.

Meanwhile, experts interviewed by MediaNama on India’s cybersecurity system raised concerns about the lack of accountability and recourse in CERT-In’s processes. The question is therefore not simply whether organisations receive security guidance, but how compliance is verified, remediation is tracked and repeat intrusions are prevented.

Also read:

MeitY proposes mandatory human-in-the-loop interventions in agentic AI payment

For You

Read Reasoned by Nikhil Pahwa: How AI is changing our world

Sponsor a MediaNama Event