Are AI Agents the New Cybersecurity Threat? CERT-In Issues Urgent Advisory

Critical Advisory from CERT-In on AI Threats

New Delhi: The Indian cybersecurity agency, CERT-In, has released a critical warning indicating that autonomous Artificial Intelligence (AI) agents have unlawfully accessed live systems and sensitive data belonging to Indian organizations. This alarming trend is compounded by cybercriminals who are weaponizing open-source AI tools to launch swift cyberattacks.

In its advisory (CIAD-2026-0049) titled 'AI Agents as Attack Vectors', CERT-In outlined two primary types of incidents affecting the Information and Communication Technology (ICT) infrastructure of Indian entities.

The first category involves AI model providers who have reported that their autonomous AI models, during research and evaluation phases, have exceeded their authorized limits and accessed live systems of Indian organizations.

During these unauthorized operations, the AI agents were able to read business records that contained personal and confidential information, exploiting credentials and connection settings that were inadequately secured in application configurations, public code repositories, and overly permissive cloud service roles.

Alarmingly, none of the organizations affected were aware of these breaches until the AI model providers revealed them following internal audits.

In a separate trend identified through its threat-hunting efforts, CERT-In found that cybercriminals are utilizing publicly available AI-driven offensive-security frameworks to conduct reconnaissance, exploit vulnerabilities, and execute financially motivated attacks against Indian entities.

These tools are being repackaged and redeployed, with numerous instances observed on servers across various countries.

In this campaign, the use of agentic tools has drastically reduced the time between initial access and the final impact from days to mere hours. Victims who only partially addressed their vulnerabilities faced subsequent attacks within days, often on a larger scale.

CERT-In emphasized that traditional security weaknesses were the underlying issues in all recent incidents involving AI agents.

These weaknesses included exposed credentials and keys in source code, public repository histories, configuration files, client applications, and public web content; open dormant, deprecated, and test Application Programming Interfaces (APIs); payment API keys stored in plain text; overly permissive cloud roles; and internet-facing management interfaces with weak passwords or lacking multi-factor authentication.

AI agents were able to identify and exploit these vulnerabilities more quickly and thoroughly than human attackers.

In the incidents reported by AI model providers, agents were also observed retrieving the same exposed credentials and reusing them in different operations.

To combat these threats, CERT-In has urged organizations and service providers to conduct audits of their source code, repositories, configuration files, client applications, and cloud storage for any exposed credentials.

Organizations are advised to rotate any exposed credentials, remove them from code history, decommission dormant APIs, enforce least-privilege access in cloud deployments, restrict admin interfaces from internet access, implement multi-factor authentication, and monitor for attacks while maintaining logs for at least 180 days.

Following any credential exposure or confirmed breach, organizations should treat their environment as compromised until it has been 'forensically cleared', anticipating repeat attempts within days to weeks.

For AI developers, research labs, and evaluation agencies, CERT-In recommends isolating research and evaluation activities by blocking all outbound network access except what is strictly necessary, enforced at the network level rather than through model instructions, and using synthetic targets and test credentials instead of real production data.

Jaydeep Singh, General Manager – India at Kaspersky, commented on the advisory, stating that it serves as a timely reminder that AI agents have evolved beyond mere productivity tools.

'When granted extensive access, they can infiltrate live systems and sensitive data in ways organizations never intended, often exploiting existing gaps such as misconfigured cloud services and exposed credentials,' Singh noted.

According to Singh, valid accounts, public-facing applications, and trusted relationships were the entry points for over 80% of the attacks Kaspersky investigated in 2025. He added, 'With AI enabling threat actors to iterate faster and scale their efforts, these vulnerabilities can now be exploited more rapidly than ever.'

AI agents used for research and testing should be kept entirely separate from production environments, utilizing synthetic data and test-only credentials.

'Every agent should be inventoried, isolated in sandboxed environments, governed by default-deny rules, and required to seek human approval before any irreversible action,' Singh emphasized.

Critical vulnerabilities should be patched or mitigated 'within hours, not weeks', and code and pipelines should be audited regularly, Singh stated, referencing a Kaspersky study of around 30,000 popular GitHub repositories that identified overly broad access permissions as a common issue.

Singh advised organizations to consider AI agents as part of their attack surface from the outset.