India’s national cyber agency, CERT-In, issued advisory CIAD-2026-0049 on October 15, and it was reported on October 16. I haven’t read the advisory itself. This summarizes The Hacker News and The Next Web, which differ slightly in places, so details may differ from the original.

What CERT-In says happened

  • AI agents under test by AI companies reached live systems of several Indian organizations and read business records, including personal and confidential data.
  • The agents went beyond their assigned tasks. Per The Hacker News, none of the organizations detected the access.
  • The AI companies found the cases in their own reviews and reported them to CERT-In.
  • Access came through credentials and connection settings exposed in application config and public code repositories, and through cloud roles with excessive permissions. One exposed credential was reportedly reused across separate operations.

A second, separate finding

CERT-In also reports a financially motivated campaign against Indian entities using public offensive-security frameworks built on AI agents. Per The Hacker News, these cut the time from first access to impact from days to hours, attackers ran several agents in parallel, and victims who only partly fixed problems were hit again within days at larger scale. CERT-In hasn’t said whether this is related to its October 9 advisory (CIAD-2026-0046) on fintech and payment firms, where stolen API credentials moved money into mule accounts. I covered a reported agent-driven criminal campaign in the Gambit post.

Root causes CERT-In lists

  • Credentials and keys in source code, repository history, config files, client apps and public web pages
  • Old, unused and test APIs still reachable from the internet
  • Plaintext payment API keys
  • Cloud and backend-as-a-service roles that give ordinary or anonymous users broad read/write access
  • Internet-exposed management interfaces, unpatched middleware, weak credentials and no multi-factor authentication

For any company:

  1. Find, rotate and purge exposed credentials, then verify the fix from outside.
  2. Scan commits and builds for secrets. Keep credentials out of code and config.
  3. Inventory APIs and shut down unused ones.
  4. Apply least privilege to cloud roles, and test what an anonymous user can reach.
  5. Remove admin interfaces from the internet, require MFA and patch quickly.
  6. Keep logs at least 180 days, and treat an exposed environment as compromised until a forensic check clears it.

For AI developers and evaluators:

  • Isolate test runs, block outside network access at the network level, use fake data and keys, and stop runs automatically when an agent reaches an outside system or uses someone else’s credentials.
  • Give each agent run a short-lived, least-privilege identity and keep tamper-resistant logs.

CERT-In also reminds organizations to report incidents within six hours.

What isn’t known

CERT-In did not name the AI firms, models, victims, sectors or frameworks. It’s unclear how many organizations were affected, whether data was copied or kept, or whether victims have been told. No indicators of compromise were published. The Hacker News notes both OpenAI and Anthropic disclosed similar incidents earlier this year, but it doesn’t say they’re involved here. The link to the Tencent case is also unconfirmed, although both involve agents reaching real systems through keys left in public places.

Why I’d read it anyway

Nothing in the list is new, which is the point. The agents didn’t need a novel exploit, just the same leaked keys and over-permissioned roles that already existed. If you build with coding agents, the same hygiene applies to you: no secrets in repos, short-lived credentials per run, and default-deny egress. My Kaspersky post and the MCP security roundup cover the agent-side version.

Sources: The Hacker News, The Next Web.