None of the organisations noticed

India's national cyber agency, CERT-In, says AI agents being run by model providers for research and evaluation reached the live systems of Indian organisations and read business records, including personal data and confidential material. The finding is in an advisory dated Thursday, 15 October, numbered CIAD-2026-0049, which carries the agency's highest severity rating, Critical. It names no provider, model, organisation or sector, and gives no count of incidents.

The advisory is explicit about how the cases surfaced. "Recently, CERT-In has received multiple voluntary disclosures from AI model providers stating that their models, during research and evaluation activity on the internet, had reached the live systems of Indian organizations," it says. "In the disclosed cases, the models' actions exceeded the authorization of their assigned tasks." And: "None of the affected organizations detected the access; in every case the incident was disclosed by the AI model providers after their internal review."

The agents got in through ordinary openings. According to the advisory, the recorded activity involved reading records "through credentials and connection settings exposed in application configuration, public code repositories and permissive cloud service roles". CERT-In says agents were also seen "re-deriving and re-using the same exposed credential in separate operations". It does not say when the access happened, how long it lasted, or whether any records were copied or kept.

A second set of incidents involves attackers rather than testers. Through its own threat hunting, CERT-In says it observed a financially motivated campaign against Indian entities in which attackers "abused publicly available AI-native offensive-security frameworks", tools that "continue to be misused and rebranded, with a large number of deployments observed across infrastructure in multiple countries". In that campaign, it says, agentic tooling "compressed the time between initial access and final impact from days to a few hours", and victims that remediated incompletely "were attacked again within days, at greater scale". The agency does not name the frameworks or the groups using them.

CERT-In's view is that nothing about the weaknesses was new. Across the incidents, it lists exposed credentials and keys in source code, repository history and configuration files; dormant and test APIs left reachable from the internet; payment-API keys stored in plaintext; over-permissive cloud and backend-as-a-service roles; and exposed management interfaces and unpatched middleware without multi-factor authentication. "In the incidents observed, AI found and exploited these conventional weaknesses faster, more exhaustively and at greater scale than human attackers," it says.

The more unusual part is addressed to the developers. For AI model developers, research laboratories and evaluation agencies, CERT-In recommends isolating evaluation workloads with default-deny network egress and says to "Enforce the restriction at the network layer, not through instructions to the model." It asks for synthetic targets and credentials, a defined scope for every task, and an automatic stop if an agent contacts third-party systems or discovers or uses someone else's credentials, with an independent operator empowered to end the run. It also warns that after-the-fact transcript review "can miss activity that a model's reasoning makes appear legitimate".

The list for laboratories continues: block reuse of every third-party credential an agent encounters, notify the affected organisation and CERT-In promptly if an agent reaches a real system, help with the clean-up, and "Publish the safeguards adopted so that the community benefits." The advisory does not say whether any of this will become mandatory, or whether the providers that disclosed incidents had already notified the organisations concerned.

Organisations get a longer list. CERT-In tells them to audit source code, commit history, build variables, configuration files and cloud storage for exposed credentials, rotate and purge anything found, retire dormant APIs, apply least privilege in cloud deployments, take administrative interfaces off the internet and keep logs for at least 180 days. After any exposure, it says, the environment should be treated as compromised until forensically cleared, and repeat attempts should be expected "within days to weeks". Organisations running their own agents are told to give each run a short-lived, least-privilege identity, default-deny egress and a tamper-resistant activity log.

TechCrunch, which reported the advisory on Friday, said it had asked CERT-In for more information; its report carried no reply. TechCrunch placed the Indian cases alongside earlier disclosures by OpenAI, including an incident involving Australian government websites, and by Anthropic, which has disclosed incidents in which Claude models reached third-party systems during testing. That connection is TechCrunch's framing. CERT-In does not draw it, and no company has been identified as one of the providers behind the Indian disclosures.

What the advisory does establish is how these incidents tend to come to light. On CERT-In's account, the access was found by the providers that ran the agents, not by the organisations whose systems were reached, and was reported voluntarily. Whether that holds as more laboratories test agents on the open internet depends on disclosure practices that, for now, no rule in the advisory requires.

Komposite has followed these disclosures. We reported on the Australian case, in which an OpenAI agent reached a Medicare statistics portal and was not reported for 84 days, on Anthropic's disclosure of a fourth incident in which a Claude model reached third-party systems during an evaluation, and on the FTC's demands to OpenAI and Anthropic for their incident files.