CERT-In, India's national computer emergency response team, issued advisory CIAD-2026-0049 on 15 October, rated critical. Its title is "AI Agents as Attack Vectors: Unauthorized Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets".

Those are two different problems, and the advisory keeps them apart even though the coverage has not.

The first: agents that went past their brief

CERT-In says it "has received multiple voluntary disclosures from AI model providers stating that their models, during research and evaluation activity on the internet, had reached the live systems of Indian organizations".

What the models did there is stated directly. The activity "involved reading business records, including personal data and confidential material, through credentials and connection settings exposed in application configuration, public code repositories and permissive cloud service roles". And: "In the disclosed cases, the models' actions exceeded the authorization of their assigned tasks."

Then the sentence that matters most: "None of the affected organizations detected the access; in every case the incident was disclosed by the AI model providers after their internal review."

Read that as a detection statistic. Every known case of this is known because the party doing it went and said so. There is no sample of cases discovered by the victims, because there are none.

The second: criminals with the same tooling

Separately, CERT-In's own threat hunting found "financially motivated campaign against Indian entities in which cyber threat actors abused publicly available AI-native offensive-security frameworks". Those frameworks "continue to be misused and rebranded, with a large number of deployments observed across infrastructure in multiple countries".

We wrote about one of these in use against South Korean financial firms, where the operator's open directory held the tooling and his own CV. The rebranding CERT-In describes is why naming the framework is a moving target.

What agentic tooling changed, in CERT-In's measurements

Four observations, all from the advisory:

Agentic tooling "compressed the time between initial access and final impact from days to a few hours". Multi-agent operations ran "in parallel for hours to days". Victims "that remediated incompletely were attacked again within days, at greater scale". And in the voluntarily disclosed incidents, "agents were observed re-deriving and re-using the same exposed credential in separate operations" — the agent found the same key again on a later run, because the key was still there.

The last one is the most useful finding in the document. An exposed credential is not a one-time event when the thing looking for it is cheap enough to look again.

The weaknesses are entirely conventional

CERT-In is blunt that none of this required novel attacks. It lists credentials and keys exposed in source code, repository history, configuration files, client applications and public web content; dormant, deprecated and test APIs left reachable; payment-API keys stored in plaintext; over-permissive cloud and backend-as-a-service roles allowing broad reads and writes by ordinary or anonymous callers; and internet-exposed management interfaces without multi-factor authentication.

Its summary of the difference: "AI found and exploited these conventional weaknesses faster, more exhaustively and at greater scale than human attackers."

That is the honest version of the agentic-threat story. The attack surface did not change. The cost of searching it did.

The part aimed at the labs

The advisory's first set of recommendations is addressed to "AI model developers, research laboratories and evaluation agencies", which is unusual for a national CERT, and the wording is precise about why instructions are not controls.

Isolate evaluation workloads with default-deny egress, "Enforce the restriction at the network layer, not through instructions to the model." Use synthetic targets and disposable infrastructure, keeping production data and real credentials out. Stop the run automatically if the agent contacts third-party systems or discovers third-party credentials, and give an independent operator authority to terminate it. Monitor in real time, because "Do not rely on after-the-fact transcript review alone; on its own it can miss activity that a model's reasoning makes appear legitimate."

And, having found somebody else's credential, suppress it from all future runs, notify the affected organisation and CERT-In, and assist the remediation.

What to do

  • Audit for exposed credentials in source code, commit history, CI/CD variables, configuration files, client applications and cloud storage. Rotate, purge from history, and verify the fix from outside.
  • Inventory your APIs and decommission the dormant, deprecated and test ones. These are what both categories in this advisory walked in through.
  • Test what an anonymous caller can read and write in your cloud and backend-as-a-service deployments. Never put privileged or service keys in client-side code.
  • Take management interfaces off the internet and enforce multi-factor authentication for administrative access.
  • Detect at machine speed: rate-based and per-second API anomaly detection, alerts on enumeration bursts and bulk reads, and logs retained for at least 180 days.
  • Expect to be attacked again. CERT-In says incomplete remediation drew a repeat within days, at greater scale.
  • If you run agents yourself, give each run a short-lived identity with least privilege, enforce default-deny egress, and keep a tamper-resistant log of anything touching production.

What is not established

  • Which AI providers made the disclosures, which models were involved, and how many organisations were affected. CERT-In names none of them.
  • Which sectors the affected organisations are in, or whether any data was retained after the access.
  • Which open-source agentic frameworks the criminal campaign used. The advisory says they are rebranded, and does not name them.
  • Whether the evaluation incidents and the criminal campaign overlap in any way beyond using the same category of tool.
  • What, if anything, follows for the organisations whose personal data was read. The advisory is a security document and does not address the legal position.