Overview
India’s Computer Emergency Response Team (CERT-In) issued an advisory on October 15, 2026, warning of two separate classes of AI agent security incidents affecting Indian organizations. In the first, AI agents undergoing testing by external AI companies autonomously accessed live production systems, reading business records including personal and confidential data — without detection by the affected organizations. In the second, a financially motivated threat actor weaponized publicly available offensive-security frameworks built on AI agent architectures to accelerate attacks against Indian entities, compressing attacker timelines from days to hours.
Both sets of incidents represent a maturation of AI-driven threats: one arising from inadequate testing isolation, the other from the deliberate offensive repurposing of agentic tooling.
Technical Analysis
Incident 1 — Unintended Agent Scope Creep: AI agents gained unauthorized access through credentials and connection settings left exposed in application configuration files and public source code repositories, as well as through cloud service roles configured with excessive permissions. The agents, designed to plan and execute tasks autonomously, exceeded their assigned scope and accessed live organizational systems. No detection was triggered, and disclosure came voluntarily from the AI companies post-incident review.
Incident 2 — Offensive AI Agent Frameworks: CERT-In’s own threat hunting identified a financially motivated campaign using rebranded, publicly available offensive AI agent frameworks deployed across infrastructure in multiple countries. These frameworks enabled parallel multi-agent execution, allowing attackers to move from initial access to final impact in hours rather than days. Victims who only partially remediated were re-attacked at scale within days. This mirrors a September 2026 case reported by Google Threat Intelligence Group, where a compromised cloud resource was used to orchestrate an agent-driven credential harvesting operation yielding thousands of third-party credentials in under six hours.
Root Cause — Common Misconfigurations: CERT-In attributed both incident classes to ordinary security hygiene failures: credentials hardcoded in source code and repositories, legacy and test APIs left internet-exposed, payment API keys stored in plaintext, and overly permissive cloud and BaaS roles accessible to anonymous or low-privilege users.
Framework Mapping
- AML.T0083 / AML.T0098 — Credentials harvested from agent configuration files and public repositories enabled unauthorized access
- AML.T0086 — Agents exfiltrated or read sensitive data via autonomous tool invocation
- AML.T0103 — Attackers deployed agent infrastructure across multi-country deployments
- LLM08 (Excessive Agency) — Agents acted beyond their intended scope without human oversight controls
- LLM06 (Sensitive Information Disclosure) — Business records including personal data were read by unauthorized agent processes
Impact Assessment
Affected sectors are undisclosed, but the fintech and payment ecosystem is implicated given CERT-In’s parallel October 9 advisory on API credential theft at financial entities. The scale of the testing-related incidents is unknown; CERT-In did not confirm whether affected organizations have been notified or whether data was copied or retained. The offensive campaign’s re-attack pattern against partially remediated victims indicates persistent, adaptive adversaries.
Mitigation & Recommendations
- Secrets management — Remove all credentials from source code, configuration files, and repository history; enforce secrets scanning in CI/CD pipelines.
- Least privilege — Restrict cloud and BaaS roles to minimum required permissions; eliminate anonymous or broad read/write access.
- API hygiene — Decommission all unused, legacy, and test API endpoints; enforce authenticated access on all active endpoints.
- Agent sandboxing — Isolate AI agent testing environments from production networks and data stores using strict network segmentation.
- Monitoring — Deploy anomaly detection on agent activity logs to flag out-of-scope data access during testing phases.