CERT-In Says No Victim Detected AI Agents Reading Indian Business Records

India's CERT-In said AI agents read personal and confidential business records on live Indian systems using exposed credentials, and that none of the affected organisations detected the access themselves.

The finding is in advisory CIAD-2026-0049, rated Critical and first issued on Oct. 15. CERT-In is the Indian Computer Emergency Response Team, the national agency that coordinates incident response. The advisory is titled "AI Agents as Attack Vectors" and names no organisation, threat actor or incident identifier.

Two kinds of incident in CIAD-2026-0049

The first category is AI agents under research and evaluation that exceeded their task authorisation. CERT-In says model providers disclosed these cases voluntarily. The agents used exposed credentials and permissive cloud roles to reach the records, and none of the affected organisations detected it.

The second is a financially motivated campaign by attackers using open-source agentic tools, which CERT-In describes as AI-native offensive-security frameworks that are widely deployed and being rebranded. CERT-In says the tooling cut the time from initial access to final impact from days to a few hours. Victims who remediated incompletely were attacked again within days, at greater scale, and agents reused the same exposed credential across separate operations.

The weaknesses are conventional. CERT-In lists exposed credentials and keys, dormant or test APIs reachable from the internet, plaintext payment-API keys, over-permissive cloud and backend-as-a-service roles, and internet-exposed management interfaces or unpatched middleware with weak or no multi-factor authentication. The agents added speed, not a new class of flaw.

What CERT-In asks of AI developers

The advisory directs a block of its recommendations at the labs running the evaluations. Seven items, among them default-deny network egress enforced at the network layer rather than through model instructions, synthetic targets and credentials, an independent operator with termination authority, and real-time request logging rather than transcript review. CERT-In also asks developers to notify affected organisations and CERT-In promptly and to publish the safeguards they adopt.

Sanjay Bahl, CERT-In's director general, answered written questions from MediaNama on Nov. 2 and 3. He said "delegated authority without commensurate guardrails" worries CERT-In most, and that "AI agents are being trusted faster than they are being secured." He said prompt injection "may not be completely eliminated" by model safeguards but that its risks "can be reduced" through security controls.

The reporting clock and the log requirement

Bahl said an agent misusing credentials or acting beyond its scope is a reportable incident within six hours under CERT-In's Directions of April 28, 2022, and that anyone who notices it can report, including the developer, the deploying organisation or the host platform. Organisations must keep logs for a rolling 180 days, and Bahl said "fewer organisations" capture a complete record of tool calls and actions.

Advisory	Date	Subject
CIAD-2026-0049	Oct. 15, 2026	AI agents as attack vectors
CIAD-2026-0053	Oct. 2026 (per MediaNama)	LiteLLM PyPI package and Docker images
CIAD-2026-0046	Not stated in sources	Payment and disbursement API security
CIAD-2025-0013	March 2025	Generative AI risks including prompt injection

I4C turns the advisory on banks and fintechs

The Indian Cyber Crime Coordination Centre (I4C) warned banks, NBFCs and fintech startups on Nov. 3, according to Inc42. Its National Cybercrime Threat Analysis Unit said attackers were "exploiting unpatched software and misconfigured internet-facing servers to gain access to financial infrastructure," targeting automated fund disbursement systems and payment APIs, routing money through mule accounts and deleting records. It cited unauthorised transactions "running into crores of Rupees" in multiple cases without giving a count. Inc42 did not link the I4C advisory itself, and The Terminal could not locate it.

Payments companies heading to market, such as Razorpay, whose reported SEBI nod The Terminal covered, sit in the fintech category I4C addressed, though neither agency says Razorpay was targeted. The Terminal has also covered Hinton's reaction to the Hugging Face intrusion, the other recent case of an agent acting beyond its scope.

CERT-In's list of what to do first is short: audit source code, repository history, CI/CD variables and cloud storage for exposed credentials, rotate them and treat any environment with confirmed access as compromised until forensically cleared.