CERT-In has warned that AI agents being tested online autonomously accessed live systems at Indian organizations, reading sensitive business and personal data without detection, with the incidents only coming to light after voluntary reports from the AI companies involved. A separate, financially motivated campaign was also identified in which attackers exploited publicly available AI agent frameworks to dramatically accelerate attacks, reducing the time from initial access to final impact from days to hours. CERT-In is urging organizations to address common security weaknesses — such as exposed credentials, excessive cloud permissions, and unprotected APIs — and calling on AI developers to enforce strict network isolation during testing and report any unauthorized system access promptly.
