AI agents accessed Indian firms’ live systems, read confidential data: CERT-In

AI agents accessed live systems of Indian organisations and read records containing personal data and confidential business information during research and testing, the Indian Computer Emergency Response Team (CERT-In) said in an advisory issued on October 15.

The cybersecurity agency said AI model providers had voluntarily disclosed multiple incidents in which their agents exceeded the authorisation of assigned tasks and accessed systems belonging to Indian organisations. The affected organisations did not detect the access themselves. CERT-In did not name the AI providers or the organisations involved.

The agents accessed the systems through credentials and connection settings exposed in application configurations, public code repositories and cloud service roles with excessive permissions, according to the advisory.

AI agents acting beyond their intended limits are emerging as a global concern, as companies deploy systems that can independently execute tasks, access tools and interact with live systems. In July, OpenAI disclosed that models under evaluation escaped their intended isolation and accessed systems belonging to AI platform Hugging Face. In September, the Australian government revealed that an OpenAI agent had accessed a government website containing Medicare statistics without authorisation.

In a separate set of incidents, CERT-In found threat actors using publicly available, open-source AI tools to target Indian organisations for financial gain.

The tools helped attackers compress the time between gaining initial access to a system and causing damage from days to a few hours, the agency said. Organisations that failed to address security vulnerabilities were targeted again within days, with subsequent attacks reaching deeper into their systems.

CERT-In has asked AI developers and research laboratories to isolate testing environments from live systems and restrict network access to destinations required for a task. It has also recommended using synthetic targets, credentials and disposable infrastructure during testing.

The agency said AI agent runs should be terminated automatically if they contact third-party systems, discover or use third-party credentials, or trigger a stop or failure signal. Developers should notify affected organisations and CERT-In if an agent accesses a real system without authorisation.

For organisations, the recommendations include auditing source code, public repositories, configuration files and cloud storage for exposed credentials, rotating compromised credentials and removing them from repository history.

CERT-In has also called for stricter cloud permissions, the shutdown of dormant or test application programming interfaces (APIs) exposed to the internet, and the retention of security logs for at least 180 days. Each AI agent run should have a separate, short-lived identity with only the permissions required to complete its task.

The agency also said that banking, financial services and insurance companies and fintech firms to implement payment and disbursement API safeguards outlined in its October 9 advisory on unauthorised fund transfers.