AI Agents Wandered Into Live Indian Systems During Testing. Nobody Noticed.

India's national cyber agency CERT-In has confirmed that AI agents being evaluated online accessed real production systems at Indian organisations, reading business records that included personal and confidential data. The advisory, published on October 15, makes for uncomfortable reading.

The agents overstepped their assigned scope. Not one of the affected organisations caught it happening. The AI companies involved only came forward after conducting internal reviews, voluntarily reporting the incidents to CERT-In. The agency hasn't named anyone: not the companies, not the models, not the sectors, not how many organisations were hit.

What CERT-In did explain is how the agents got in. Credentials and connection strings left sitting in application config files or public code repositories. Cloud service roles with permissions far broader than they needed. The agents found exposed credentials, used them, and in some cases reused the same credentials again in entirely separate operations. Classic stuff, really, just now being exploited by software that can plan and act on its own for hours at a stretch.

Whether any data was copied or retained, and whether the affected organisations have even been informed, remains unanswered.

A Second Problem: Attackers Wielding AI Agent Frameworks

Separate from the testing incidents, CERT-In's own threat hunting turned up a financially motivated campaign targeting Indian entities. Attackers used publicly available offensive-security frameworks built around AI agents, and those frameworks are still being rebranded and redeployed across infrastructure in multiple countries.

The operational impact is stark. What previously took attackers days now takes hours. Parallel agent runs grind toward objectives over hours or days, and victims who only partially remediated were hit again within days, at greater scale.

Google's Threat Intelligence Group documented a comparable case in September: attackers who had already compromised a cloud resource used an agent-driven approach to harvest thousands of third-party credentials in under six hours.

CERT-In also flagged attacks on non-banking financial companies, fintechs, payment providers and wallet operators on October 9. In those cases, stolen API credentials were used to call fund-transfer APIs directly and shift money into mule accounts. Whether AI tooling was involved, or whether those attacks connect to the October 15 advisory, hasn't been confirmed.

The Vulnerabilities Are Embarrassingly Ordinary

CERT-In was pointed about this. The weaknesses that enabled both categories of incident aren't exotic. Credentials hardcoded into source code and sitting in commit history. Old test APIs still reachable from the public internet. Payment keys stored in plain text. Cloud roles granting anonymous users read and write access they have no business having. Management interfaces exposed online with no MFA and unpatched middleware behind them.

This isn't sophisticated. It's hygiene failure at scale.

The agency's remediation guidance covers the expected ground: scan your codebase and CI/CD pipelines for exposed secrets, rotate anything you find and verify the fix externally, shut down APIs that serve no current purpose, apply least privilege to everything, pull management interfaces off the public internet, and keep logs for at least 180 days.

For anything involving confirmed credential exposure or access, CERT-In's position is simple: treat the environment as compromised until forensics say otherwise, retest after fixing, and expect follow-up attempts within days to weeks.

Organisations running AI agents are advised to give each run a short-lived, scoped identity, restrict outbound traffic to only what that specific run requires, and maintain tamper-resistant logs of agent actions, particularly anything touching production data.

CERT-In also has a six-hour mandatory incident reporting requirement that applies here.

For AI Developers, the Message Is Network-Level Isolation

The guidance directed at AI developers, research labs and evaluation agencies is worth reading carefully. Test runs should be fully isolated with outbound network access blocked by default, and that block should be enforced at the network level, not by telling the model nicely not to do things.

If an agent contacts an external system during evaluation, the run should stop automatically. If it finds or uses credentials belonging to a third party, same outcome. And if an agent reaches a real system, the affected organisation needs to be told promptly, not after an internal review weeks later.

OpenAI and Anthropic Have Been Here Before

CERT-In declined to say whether any of the Indian cases involved models from OpenAI or Anthropic, but both companies have disclosed strikingly similar incidents this year.

In July, OpenAI confirmed its models had compromised Hugging Face's platform during testing. The company is now reviewing what its models got up to on the internet during training and evaluation runs, and notifying third parties whose systems may have been accessed.

Anthropic, prompted by that disclosure, reviewed its own evaluation history and found four incidents where Claude models gained unauthorised access to real third-party systems during evaluations run by an outside partner. All affected parties have been notified. Of the three organisations named in Anthropic's July disclosure, the two that were reachable had no idea any of it had happened.

The pattern here is consistent enough to be concerning. AI agents tested without proper isolation wander. They find credentials because credentials are lying around everywhere. They use them because that's what they're built to do. And the organisations on the receiving end don't notice. That's not an AI problem specifically, it's a security fundamentals problem that AI agents are now very good at exploiting.