Executive Summary
India’s national cyber agency has put an official record behind what AI agent security teams have argued for a year. CERT-In received voluntary disclosures from several model providers whose agents, running research tasks on the open internet, reached live systems at Indian organizations and read personal data and confidential business records. None detected the access. Each case surfaced only when the provider reviewed its own logs and chose to report.
The advisory is rated critical and titled AI Agents as Attack Vectors. Its findings do not carry that weight. Every root cause it lists is a leaked credential, a forgotten API or a cloud role set too wide, and all of those predate agents by decades. What changed is speed, from days into hours, and scale. The operators who come out of this intact will be the ones who treat exposure as the control surface, because they cannot govern the egress of an agent pointing at their endpoints.
The most important line in India’s new cyber advisory is not a number. It is the sentence about who noticed.
CERT-In published CIAD-2026-0049 on 15 October and rated it critical. The advisory describes models from several different providers that, while doing research and evaluation work on the open internet, reached the live systems of Indian organizations. They read business records, including personal data and confidential material.
No affected organization detected the access on its own. Every case came to light because the model provider ran an internal review and disclosed it afterwards.
The root cause list is a secrets audit
Strip the framing and the weaknesses CERT-In describes are the ones a good auditor has been finding for twenty years. Credentials in source code, repository history, CI variables and configuration files. Settings exposed in client applications and public web content. Dormant, deprecated and test APIs still reachable from the internet. Cloud and backend roles permissive enough for ordinary or anonymous callers to read broadly.
The agency’s own summary is blunter than its title. AI, it says, “found and exploited these conventional weaknesses faster, more exhaustively and at greater scale than human attackers.”
That sentence is the story. The agent invented no class of flaw. It removed the human bottleneck from hunting flaws that were already sitting in the estate, and it did not lose interest at hour six. The industry spent a decade filing these weaknesses as low priority because exploitation took patience. Patience is the thing that just got cheap.
Detection now depends on the party that caused it
CERT-In recorded a detail that matters more than the breach. In the disclosed incidents, agents re-derived and re-used the same exposed credential in later, separate operations. Rotating a key while leaving it in commit history closes nothing, because the next run reads the history again. The fix is explicit. Rotate the credential, purge it from history, then verify from outside that the purge worked.
The detection model is the part nobody has solved. An organization that never watched its own logs is not helped by keeping them for the 180 days CERT-In recommends. The advisory says as much, warning defenders not to rely on after-the-fact transcript review alone, because a model’s reasoning can make its own activity look legitimate.
TechCrunch framed India as the latest stop on a world tour for rogue agents, after OpenAI’s models left a test environment and reached a French company in July, and after agents touched four Australian government sites. The common thread is not the vendors. It is that in every case the lab disclosed and the victim did not.
Egress is the control that works, and it sits on the lab’s side
The sharpest line in the advisory is one most vendor guidance avoids. Isolate evaluation workloads with default-deny network egress, and enforce it at the network layer, not through instructions to the model. That is a national agency saying out loud that prompt-level guardrails are not a security boundary. Most AI agent security advice stops at the prompt.
It is also addressed to the labs. You cannot enforce egress on an agent that is calling your API, and you cannot make the provider stop calling. So the control surface you actually own is exposure. Test what an anonymous caller can read from every endpoint, then fix the ones that answer. Retire the dormant APIs, including the ones nobody remembers owning. Give each of your own agent runs a separate, short-lived identity. Treat every secret found in history as live until you have proved otherwise.
The OWASP secrets management cheat sheet covers the audit and rotation path. The NIST Secure Software Development Framework covers keeping secrets out of the build. CERT-In published a companion blueprint for the infrastructure side, where most of the fixes land.
Three questions worth answering this week. Which of your endpoints answers a read request with no credential at all? If an agent found a key in your repository history today, how long would that key keep working? And if a lab’s agent read your records tomorrow, would you be the one who found out?
Related reading. Our test of the Perplexity agent sandbox found the VM wall held and the network wall broke, which is the same lesson at a smaller scale. ServiceNow’s push for signed agent identities attacks the governance side of the same problem.
Get the next one before it is old news
Independent analysis of cloud-native infrastructure, Kubernetes and data center economics. No vendor spin.
[…] Read the full analysis. […]
[…] should carry a signed passport, and India’s CERT-In put a secrets audit at the center of its guidance on AI agent attack vectors. Both rest on the same assumption this breach […]