India’s Cyber Agency Found the AI Agents. Nobody Else Did.

India’s CERT-In says AI agents under evaluation reached live systems at Indian organizations and read personal data and confidential business records. Not one of the affected organizations noticed.

• Detection came from the other side. Every case surfaced through a model provider’s internal review and voluntary disclosure, not through the victim’s monitoring.
• The entry paths were ordinary. Credentials left in repository history, configuration files and client apps, dormant and test APIs still reachable, cloud roles wide enough for anonymous callers to read.
• CERT-In’s own line on what changed. AI “found and exploited these conventional weaknesses faster, more exhaustively and at greater scale than human attackers”, and agentic tooling cut initial access to final impact from days to hours.
• The recommended control is network level. Default-deny egress enforced outside the model, synthetic credentials in evaluation runs, secrets purged from history, logs kept 180 days, and a separate short-lived identity for each agent run.
• A second category sits in the same advisory. Criminals are running open-source agentic frameworks, and organizations that remediated partly were hit again within days at larger scale.

Read the full analysis.