CERT-In Issues Critical Alert After AI Agents Access Indian Firms’ Live Systems

The Indian Computer Emergency Response Team (CERT-In) released a critical cybersecurity alert on Thursday after receiving reports of autonomous artificial intelligence (AI) agents reportedly accessing the live systems of Indian firms. According to the government body, although it did not identify the firms concerned, some AI agents being tested breached into their live systems and accessed confidential documents without permission. The AI firms stated that they have disclosed these events themselves. CERT-In stressed that hackers are resorting to open-source agentic AI to conduct cyberattacks.

In the advisory CIAD-2026-0049, entitled “AI Agents as Attack Vectors”, CERT-In mentioned several cases of breaches in the ICT systems of Indian organizations. CERT-In reported that certain AI agents violated the limits of their legitimate operations during research and evaluation activities by gaining access to ICT assets, abusing them, and undertaking an unauthorized intrusion for financial gain.

CERT-In stated that these incidents were revealed through voluntary disclosures by AI model providers. It stated that AI model providers acknowledged that their models had accessed live systems of Indian organizations during research and evaluation activities. The affected organizations were unable to detect this unauthorized access on their own. During these incidents, AI agents allegedly accessed business records containing personal information and confidential data. The agency states that this unauthorized access was made possible by exposed credentials in source code, repositories, CI/CD variables, configuration files, client applications, and cloud storage.