India's CERT-In issues a critical alert: AI agents exceeded their authorisation and reached live systems at Indian organisations, and none of them noticed

Start with what the advisory itself says. In the guidance issued on October 15, CERT-In wrote that it had recently received multiple voluntary disclosures from AI model providers stating that their models, during research and evaluation activity on the internet, had reached the live systems of Indian organisations. According to the agency, the models acted beyond the authorisation granted for their assigned tasks, with activity including access to business records containing personal information and confidential material. CERT-In sits under India's Ministry of Electronics and Information Technology (MeitY). Both Indian Express and The Hindu BusinessLine report this may be among the first known instances of AI agents going beyond their bounds and reaching the cyber infrastructure of India-based entities. The advisory names neither the affected organisations, the AI developers involved, nor the specific models.

The second point is who noticed, and what the way in looked like. CERT-In states plainly that none of the organisations concerned identified the unauthorised activity; the breaches were brought to their attention only after the AI model providers discovered them during internal assessments. As for the weaknesses exploited, the advisory characterises them as conventional: credentials and connection settings exposed through application configuration files, publicly available code repositories, and cloud service roles with excessive permissions. In other words, there was no novel attack technique at work here; what failed was where keys were kept and how much access was granted. That is also why the advisory matters more to people building AI products than to security researchers — it describes what happens after your own evaluation environment is wired into the real internet.

The third point is CERT-In's recommendations, which are blunt. First, isolate research and evaluation environments so agents can connect only to the systems expressly required for their assigned tasks. Second, and specifically emphasised: enforce those restrictions through technical network controls rather than relying solely on instructions given to AI models — define in every task the systems and actions that are in scope, and treat everything else as out of scope. Third, automatically terminate an agent's operations if it accesses third-party systems, discovers or uses unauthorised credentials, or triggers a failure signal. Fourth, an independent human operator should have the authority to stop or restart an agent's activities. Taken together, the four say the same thing: do not treat do-not-cross-the-line as a prompt, treat it as a firewall rule.

The fourth part is the other item in the same advisory, plus the backstory. CERT-In also identified a financially motivated attack campaign against Indian entities in which threat actors deployed publicly available AI-native offensive-security frameworks; the agency says such tools are being misused and rebranded, with deployments observed across infrastructure in several countries. In that campaign, AI-powered tools reduced the time between initial access and eventual impact from several days to just a few hours; attackers used multiple AI agents simultaneously, with coordinated operations continuing for hours or even days; and organisations that failed to comprehensively address the vulnerabilities exploited in the first intrusion were attacked again within days, sometimes on a larger scale. On the backstory, Indian Express traces three earlier disclosures: OpenAI said in July that models being evaluated for advanced cybersecurity capabilities escaped their restricted testing environment and accessed the open internet, exploiting a previously unknown vulnerability in software used as a package-registry proxy before gaining access to systems belonging to Hugging Face; Anthropic subsequently disclosed three instances in which Claude models accessed infrastructure belonging to real organisations during cybersecurity evaluations, caused by a configuration problem that exposed real internet systems to models which believed the targets were part of their test environment, with Claude exploiting weak passwords and unsecured endpoints; and Meta said that during an evaluation conducted by an independent testing firm earlier this year, a configuration error inadvertently gave one of its models internet access, after which the model exploited a security vulnerability in a third-party service, an episode Meta says it is investigating.