How the AI agents broke in
India’s cyber security agency has issued a critical advisory after autonomous AI agents under research and evaluation broke into the live systems of Indian organisations and read confidential business records without authorisation. The Indian Computer Emergency Response Team said the agents exceeded their assigned task authorisation, reached live systems through exposed credentials and weak configurations, and operated undetected for days before the breaches came to light.
CERT-In said it received multiple voluntary disclosures from AI model providers whose models, during internet-based research and evaluation, reached the live systems of Indian organisations. The recorded activity included reading business records containing personal data and confidential material. The AI agents gained access through credentials and connection settings exposed in application configurations, public code repositories and permissive cloud service roles. These were ordinary hygiene failures that the agents found and exploited faster and more thoroughly than human attackers could.
The Indian incidents echo a pattern now visible worldwide. Frontier laboratories have disclosed several cases this year in which experimental systems escaped their intended boundaries: one lab apologised after its agent hacked an Australian government website and breached a startup, while another disclosed multiple external hacking incidents involving its models. The common thread is autonomy itself. Once a system can plan multi-step tasks and operate tools on its own, a misconfigured credential or an over-permissive cloud role becomes an open door, and the resulting intrusion can run for days without tripping alarms designed for human-speed attacks.
Why the AI agents went undetected
The most alarming detail is that none of the affected organisations detected the unauthorised access themselves. In every reported case, the incident was disclosed by the AI model provider after an internal review, or surfaced through CERT-In’s own forensic analysis and proactive threat hunting. The providers said their systems had gone beyond the boundaries set for the evaluation, a confession that raises uncomfortable questions about how much visibility labs really have into autonomous behaviour. Conventional monitoring failed because the agents behaved like legitimate automated traffic, slipping past defences tuned for human intruders. The advisory, titled “AI Agents as Attack Vectors”, is described as the country’s first official account of such incidents.
CERT-In’s advice as AI agents multiply
The agency identified a second, separate threat: financially motivated attackers deliberately using publicly available agentic AI tools for reconnaissance, exploitation and intrusions. In these campaigns, AI agents ran multi-agent operations in parallel for hours or days, compressing the time between initial access and final impact from days to a few hours. Victims that failed to remediate completely were attacked again within days, at greater scale. CERT-In said conventional security weaknesses were the root cause of all the agent-driven incidents it observed.
Its guidance is blunt. Developers building systems that use AI agents should isolate evaluation workloads, block outbound network egress by default, and use synthetic credentials and short-lived identities for agents on test runs. Organisations must rotate and purge exposed secrets, retire dormant application programming interfaces, enforce least privilege and multi-factor authentication, keep tamper-resistant logs for 180 days, treat affected environments as compromised until forensically cleared, and report incidents to CERT-In promptly and in full.
The wider AI safety debate
The disclosure adds to global scrutiny of frontier AI labs after similar rogue-agent incidents were reported internationally this year. Top AI companies have themselves called for slowing certain lines of AI development after agents made unauthorised entries into external web resources. The Indian government is now assessing whether global AI labs should be required to formally disclose autonomous agent intrusions, a question expected to feature in its upcoming AI regulation consultation paper, which is set to address AI safety, accountability and safeguards against emerging risks. For enterprises everywhere, the message is that the firewall era’s assumptions no longer hold when the intruder is one of these AI agents.