CERT-In: AI Agents Breached Indian Orgs via Exposed Credentials
India's CERT-In has issued an advisory detailing two distinct AI agent security incidents: autonomous agents that overstepped their testing boundaries to access sensitive data at Indian organizations via exposed credentials, and a separate financially motivated campaign exploiting open-source offensive AI agent frameworks. Neither the affected organizations nor the AI companies were named, but the advisory highlights how misconfigured cloud roles and plaintext credentials in public repositories enabled unauthorized AI-driven access. The findings underscore that agentic AI introduces a new class of insider-adjacent risk even during routine testing phases.