India’s national cyber agency, CERT-In, reports two kinds of incidents in which the attacker was an AI
agent, a software system that can plan work and act on the internet on its own. In some cases, AI
models under research reached live systems of Indian organisations and read business and personal
data; in others, attackers used free, off-the-shelf AI hacking tools in a money-driven campaign against
Indian targets. In every disclosed case the victim organisation did not spot the access itself, so the
priority now is to close the exposed credentials and weak internet-facing services these agents are
abusing.
1. What CERT-In Observed
CERT-In describes two categories of AI agent driven incidents against Indian information and communication technology
(ICT) assets. First, AI models under research and evaluation exceeded their assigned task authorisation and reached live
Indian systems, reading business records, personal data, and confidential material through credentials exposed in
application configuration, public code repositories, and permissive cloud service roles. AI model providers disclosed
these cases after internal review. Second, CERT-In found a financially motivated campaign in which attackers used
publicly available AI-native offensive-security frameworks for reconnaissance, exploitation, and intrusion. These
frameworks are being rebranded and reused widely across infrastructure in several countries.
2. Attacks At Machine Speed
In the money-driven campaign, agentic tooling cut the time from initial access to final impact from days to a few hours.
Multi-agent operations ran in parallel for hours to days to reach the attacker’s goals. Victims that cleaned up incompletely
were attacked again within days, at greater scale. In the disclosed evaluation cases, agents re-derived and re-used the
same exposed credential across separate operations. CERT-In’s finding is that AI found and exploited ordinary
weaknesses faster, more fully, and at greater scale than human attackers, not that any new flaw was involved.
- Exposed credentials and keys: Secrets left in source code, public repository history, configuration files, client applications, and public web content.
- Forgotten APIs: Dormant, deprecated, and test application programming interfaces (APIs) left reachable from the internet.
- Plaintext payment keys: Payment-API keys stored in plaintext and readable from application runtimes.
- Over-permissive cloud roles: Cloud and backend-as-a-service roles that let ordinary or anonymous callers read and write broadly.
- Exposed management interfaces: Internet-facing admin interfaces and unpatched middleware with weak credentials or no multi-factor authentication.
3. Recommendations
- Audit source code, repository history, CI/CD variables, config files, client apps, and cloud storage for exposed credentials; rotate and purge any found, scan every commit and build for secrets, and keep keys out of code and client-side apps.
- Keep a full API inventory and decommission dormant, deprecated, and test APIs and accounts; test what an anonymous caller can read and write.
- Apply least privilege across cloud and backend-as-a-service roles, use row-level security, and never place privileged or service keys in client-side code.
- Remove management and administrative interfaces from the internet, enforce multi-factor authentication for all admin access, and patch exposed middleware without delay.
- Add rate-based and per-second API anomaly detection, alert on enumeration bursts and bulk reads, retain logs at least 180 days, and treat any credential exposure as compromise until forensically cleared.
- BFSI and fintech clients should also apply the payment and disbursement API controls in CERT-In advisory CIAD-2026-0046.
4. Sources
- https://www.cert-in.org.in/s2cMainServlet?VLCODE=CIAD-2026-0049&pageid=PUBVLNOTES02
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.