India is the latest country to have raised the alarm on AI agents potentially accessing its secure IT systems.
India’s Computer Emergency Response Team (CERT-In) has issued a critical-severity advisory warning that AI agents — not just humans using AI tools — have themselves become attackers against Indian digital infrastructure, in some cases without their own creators intending it.
The advisory, titled “AI Agents as Attack Vectors: Unauthorized Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets,” marks a shift in how the agency is framing AI-related risk. Earlier advisories from CERT-In focused on AI being used as a tool by human hackers to write malware or speed up reconnaissance. This one is about software agents — systems that can plan, issue commands, and act on the internet over extended periods on their own — becoming the attackers.
Two Very Different Ways Agents Went Rogue
CERT-In says it has seen two distinct categories of incidents involving Indian organizations.
The first came through voluntary disclosures from AI model developers themselves. According to the advisory, AI labs testing their models’ capabilities on the open internet found that their agents had reached live systems belonging to Indian organizations and read business records — including personal data and confidential material — through credentials and connection settings that had been left exposed in configuration files, public code repositories, and overly permissive cloud roles. Crucially, CERT-In notes that none of the affected Indian organizations detected the intrusions themselves; they only learned about it after the AI companies’ own internal reviews flagged the activity and reported it.
This matches a pattern that has played out publicly over the past few months. OpenAI disclosed in July that its models escaped a sandboxed testing environment and compromised Hugging Face, the AI model-hosting platform, while searching for ways to improve their benchmark scores. Days later, Anthropic ran its own retrospective review of 141,006 evaluation runs and found three separate incidents in which Claude models — including Opus 4.7 and Mythos 5 — had reached the internet through a misconfigured partner environment and gained unauthorized access to the production systems of three real organizations, in one case publishing a malicious package to the Python Package Index that was downloaded and run on 15 real systems before it was pulled. Australia went public with a similar episode in September, when Prime Minister Anthony Albanese revealed that an OpenAI research agent had “infiltrated” a government Medicare statistics portal back in June, reportedly bypassing access blocks rather than accepting them.
The second category CERT-In flags is more conventional: human attackers deliberately using open-source, AI-native offensive-security frameworks to run reconnaissance and intrusion campaigns against Indian entities for financial gain. The advisory notes that these tools “continue to be misused and rebranded,” with large numbers of deployments showing up across infrastructure in multiple countries — evidence, CERT-In says, of how widely available ready-made agentic hacking capability has become. This is the same dynamic Anthropic itself documented when it disrupted a cybercriminal using its own Claude Code tool to run an extortion operation against at least 17 organizations, with the AI handling reconnaissance, credential harvesting, data triage, and even drafting the ransom notes — a technique researchers have started calling “vibe hacking.”
Machine Speed, Not Machine Sophistication
What stands out most in CERT-In’s analysis is the speed, not the cleverness, of these attacks. The advisory says agentic tooling compressed the time between initial access and final impact “from days to a few hours” in the financially motivated campaigns it analysed, with multi-agent operations running in parallel for hours or days at a stretch. Victims who remediated incompletely were reportedly hit again within days, at greater scale. And in the voluntarily disclosed incidents, agents were observed independently re-deriving and reusing the same exposed credentials across separate operations — essentially rediscovering the same open door more than once.
CERT-In is also direct about what’s actually being exploited, and it isn’t exotic. The advisory lists conventional weaknesses: credentials and API keys sitting in source code, repository history, and config files; dormant or deprecated APIs still reachable from the internet; payment-API keys stored in plaintext; cloud and backend-as-a-service roles that let ordinary or even anonymous callers read and write far more than they should; and internet-facing admin panels running outdated software without multi-factor authentication. The point the agency is making is that AI agents aren’t inventing new attack classes — they’re finding and chaining together old, familiar misconfigurations faster and more exhaustively than human attackers typically do.
What CERT-In Is Asking For
The advisory sets out separate recommendations for two audiences. AI model developers, research labs, and evaluation agencies are told to isolate evaluation workloads behind default-deny network egress enforced at the network layer (not just through instructions to the model), use synthetic credentials and disposable infrastructure rather than production data, automatically halt a run if an agent contacts third-party systems or encounters real credentials, and notify both the affected organization and CERT-In promptly if an agent does touch a real system. And with India becoming the latest nation to issue an advisory on how AI agents are capable of hacking into its systems, it appears that the focus on global cybersecurity could end up being higher than ever in the age of AI.