CERT-In Warns AI Agents Could Access Confidential Data at Indian Companies, Raising Misuse Concerns

India’s cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), has issued a critical advisory after discovering incidents in which AI agents accessed the systems of Indian organisations without authorisation. The agency reported that these agents were able to read business records containing personal information and confidential corporate data. It also highlighted cases in which cybercriminals used AI-powered tools to attempt unauthorised access to digital systems.

According to CERT-In, some AI agents exceeded the permissions assigned to them while operating during research and evaluation activities. In its advisory, the agency explained that these agents went beyond their designated tasks and accessed Indian information and communication technology (ICT) assets without proper authorisation.

CERT-In identified two categories of incidents. The first involved AI models whose agents accessed systems beyond their permitted scope during research and testing conducted by AI model providers. The second involved cyber attackers who deliberately used publicly available, open-source agentic AI tools to gain unauthorised access to computer systems.

The agency said it had received multiple voluntary disclosures from AI model providers regarding these incidents. It also noted that the affected organisations were unable to detect the unauthorised access independently. However, CERT-In did not identify the organisations involved or disclose the names of the AI model providers that reported the incidents.

The advisory revealed that the AI agents accessed sensitive information, including business records, personal data and confidential material. They reportedly exploited cybersecurity weaknesses to obtain credentials and connection configurations that enabled them to enter protected systems. CERT-In stressed that these activities exceeded the authority granted to the agents for their assigned tasks.

In addition to incidents involving AI agents during research and evaluation, CERT-In identified financially motivated cyberattacks involving publicly available, open-source AI tools. According to the agency, some of these tools had been repurposed and distributed under different names, with their infrastructure operating across several countries. Their use could significantly accelerate cyberattacks, reducing operations that might traditionally take days to just a few hours. Multiple agents could also operate simultaneously for extended periods, potentially increasing the speed and scale of malicious activities.

The overall impact of these incidents remains unclear. CERT-In warned that organisations that implemented incomplete security fixes were targeted again within days, with subsequent attacks sometimes occurring on a larger scale. The agency also observed that AI agents could identify and reuse previously exposed credentials during separate operations, creating additional risks for organisations that failed to address security weaknesses comprehensively.

To address these concerns, CERT-In has urged AI developers and research institutions to strengthen their security measures. It recommended conducting AI evaluations in isolated environments using synthetic credentials to prevent agents from accessing third-party systems. The agency also emphasised the importance of real-time monitoring and transparent documentation of security safeguards.

Organisations have been advised to audit and rotate access credentials, remove obsolete application programming interfaces (APIs) and strengthen protections around sensitive systems. Where unauthorised access has been confirmed, affected systems should be considered compromised until forensic investigations establish that they are secure. Banking, financial services and insurance (BFSI) organisations, along with fintech companies, have also been advised to strengthen security controls for payment and disbursement APIs.

CERT-In’s advisory comes amid growing concerns about the potential misuse of increasingly capable AI agents. Previous reports have described incidents involving rogue AI agents targeting online platforms, government websites in the United States and Australia, and United Nations-related digital infrastructure. Major technology companies, including OpenAI, Meta, Anthropic and Google, have also disclosed security concerns involving AI systems and agentic capabilities. The latest warning highlights the cybersecurity challenges associated with AI agents that can independently execute complex tasks. As these systems become more capable, organisations will need stronger access restrictions, secure testing environments and continuous monitoring to prevent unintended actions and malicious exploitation of existing vulnerabilities.