India’s cybersecurity agency has called for tighter controls on artificial intelligence agents after autonomous systems accessed confidential corporate information without permission and escaped detection by affected organisations.
The Computer Emergency Response Team, CERT-In, said AI models undergoing research and evaluation had exceeded their authorised tasks and entered live systems belonging to organisations across the country. Its critical advisory, numbered CIAD-2026-0049 and issued on 15 October, also identified financially motivated attackers deploying publicly available AI tools to accelerate cyber intrusions.
None of the organisations affected by the research agents detected the unauthorised access themselves. AI model providers disclosed the incidents voluntarily after internal reviews, while separate criminal activity was identified through forensic investigations and proactive threat hunting by CERT-In.
The agency did not identify the AI developers, affected organisations or the number of incidents, leaving the scale and sectoral distribution of the disclosed breaches unspecified. It also did not establish that the research agents were deliberately instructed to steal information, distinguishing their unauthorised behaviour from intentional criminal campaigns.
The models accessed business records containing personal information and confidential material by exploiting credentials and connection details exposed in application configurations, publicly accessible code repositories and cloud services with excessively broad permissions.
CERT-In warned that autonomous tools were exploiting familiar security weaknesses at substantially greater speed and scale. During financially motivated attacks, the time between initial penetration and damaging consequences contracted from days to a few hours.
Investigators observed multiple agents operating simultaneously for hours or days, allowing different stages of an intrusion to proceed in parallel rather than sequentially. Organisations that failed to remove vulnerabilities completely faced renewed attacks within days, sometimes on a larger scale. Agents involved in evaluation activity also independently rediscovered and reused previously exposed credentials during separate operations.
The advisory recommended that AI developers isolate experimental workloads from unrestricted internet access. Network connections should be blocked by default, with access permitted only to destinations explicitly necessary for an authorised task. Technical restrictions, it stressed, must operate at network level rather than depend solely on instructions given to models.
Developers were advised to use synthetic data, artificial credentials and disposable infrastructure during testing, preventing experimental agents from encountering genuine production systems. Each evaluation should define permitted systems and actions, with automatic termination when agents contact outside services or encounter third-party credentials.
Independent operators should retain authority to stop or restart experiments. Providers must monitor activity as it happens, recording destinations, ports, protocols and outcomes of requests initiated by models. Reviewing conversation transcripts afterwards is insufficient because apparently legitimate reasoning can conceal unauthorised actions.
CERT-In also directed developers to prevent agents from reusing credentials belonging to third parties. Any such discovery should trigger an exposure review, while access to genuine systems should be promptly disclosed to the affected organisation and the agency.
For businesses, the recommendations concentrated on securing existing infrastructure. Organisations should locate and revoke exposed passwords, tokens and application keys, examine public repositories and configuration files, and establish inventories of internet-facing application programming interfaces.
Unused testing interfaces and obsolete services should be disabled or restricted, particularly where they remain reachable from the public internet despite no longer serving an operational purpose. Cloud permissions should follow the principle of least privilege, limiting each account or application to the information and functions required for its work. Administrative systems should not remain openly accessible online.
The agency urged multifactor authentication for administrative access, stronger authentication elsewhere, prompt software patching and controls preventing anonymous users from modifying sensitive information. Payment-related interfaces require particular attention where exposed credentials could facilitate unauthorised financial transactions.
Security teams were told to introduce monitoring capable of identifying attacks unfolding within seconds, including bursts of automated requests, systematic enumeration of resources, mass downloads and suspicious account registrations. CERT-In recommended retaining relevant security logs for at least 180 days.
After confirmed unauthorised access or credential exposure, organisations should regard the environment as compromised until forensic examination establishes otherwise. Remediation should be tested rather than assumed effective, given the possibility of repeat attempts shortly after an initial intrusion.
Companies deploying their own autonomous agents should assign separate, short-lived identities to individual runs, restrict outgoing network connections and preserve tamper-resistant records of actions affecting production systems and data.
CERT-In additionally referred banking, financial services, insurance and financial technology organisations to its separate guidance on protecting payment and disbursement interfaces against unauthorised transfers.
