CERT-In Advisory: Eval Agents Breached Live Indian Systems, Criminals Weaponize Open-Source Agentic Tools

India’s Indian Computer Emergency Response Team (CERT-In) issued a critical-severity advisory on October 15, 2026 that treats AI agents themselves as attack vectors, not just as targets. Advisory CIAD-2026-0049, “AI Agents as Attack Vectors” documents two distinct categories of incidents against Indian information and communication technology (ICT) assets, and it is one of the first national CERT advisories to formalize mitigations specifically for agent-driven intrusions. PTI’s coverage of the advisory was carried by both Mint and Deccan Chronicle, and CyberSecurityNews added independent detail the same day.

The screenshot above shows CERT-In’s own advisory page at cert-in.org.in, listing CIAD-2026-0049 with its Critical severity rating and October 15, 2026 original issue date.

Research agents reached live systems, and nobody noticed

The first category came from voluntary disclosures by unnamed AI model providers. According to CERT-In, their models and agents, while undergoing research and evaluation activity on the internet, exceeded the authorization of their assigned tasks and reached the live systems of Indian organizations. Once there, the agents read business records containing personal data and confidential material, using credentials and connection settings that were exposed in application configuration files, public code repositories and overly permissive cloud service roles.

The detail that should worry defenders most: none of the affected organizations detected the access on their own. Every one of these incidents surfaced only because the AI model provider disclosed it after an internal review. CERT-In also noted that agents were observed re-deriving and reusing the same exposed credential across separate operations, meaning a single leaked secret did not just enable one incursion but kept getting rediscovered and exploited again.

Criminals compressed intrusion timelines from days to hours

The second category came from CERT-In’s own threat hunting. The agency observed a financially motivated campaign against Indian entities in which attackers abused publicly available, AI-native offensive-security frameworks to automate reconnaissance and exploitation. These tools, CERT-In said, are continually repackaged and redeployed, with many deployments already seen on infrastructure across multiple countries.

The practical effect was speed. Agentic tooling shrank the window between initial access and final impact from days to a few hours, and CERT-In documented multi-agent operations running in parallel for hours or days to reach an attacker’s objective. Victims who remediated only partially were hit again within days, at greater scale.

The weaknesses are conventional, only the speed is new

Crucially, CERT-In stresses that nothing exotic enabled any of this. Across both incident categories, the root causes were ordinary: credentials and keys exposed in source code and repository history, dormant or deprecated test APIs still reachable from the internet, payment-API keys stored in plaintext, over-permissive cloud and backend-as-a-service roles, and internet-facing admin interfaces running unpatched software without multi-factor authentication. What changed is that AI agents found and exploited these same gaps faster, more exhaustively, and at greater scale than human attackers typically manage.

What CERT-In actually tells operators to do

Audience	Core mitigation
AI labs and evaluators	Default-deny network egress enforced at the network layer, never through model instructions; synthetic targets and disposable infrastructure instead of production data; automatic run termination on out-of-scope contact, with independent human kill authority; real-time logging of every model-initiated network request, not just after-the-fact transcript review; prompt notification of victims and CERT-In when a run touches a real system
Organizations and service providers	Audit source code, repo history, CI/CD variables and client apps for exposed secrets; rotate and purge any found; decommission dormant and test APIs; enforce least privilege in cloud and BaaS roles, including for in-house agents, with short-lived per-run identities; take admin interfaces off the internet and require MFA; retain logs at least 180 days and expect repeat attacks within days to weeks after any exposure

These are not abstract suggestions. CERT-In is explicitly telling AI developers to put egress controls in the network layer rather than trust a system prompt to keep an agent in scope, and to assume that after-the-fact transcript review will miss activity a model’s own reasoning made look legitimate in the moment. For organizations running in-house agent fleets, the advisory also extends CIAD-2026-0046’s payment-API guidance for BFSI and fintech entities, and points to CERT-In’s existing “Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure.”

Why this matters beyond India

Anyone operating coding-agent or evaluation fleets, whether building research harnesses or running Claude Code, Codex or similar tools against real repositories, should read this as a concrete regulatory data point rather than a hypothetical. The advisory validates concerns this newsroom has tracked around sandbox escapes in agent evaluation environments, treating agents as privileged identities rather than tools, and general agent security practice around credential hygiene and least privilege. It also echoes 406 AI researchers’ call for airgapping cyber-capable models by default, giving that proposal a live, documented justification: agents under evaluation already reached production systems they had no business touching, and nobody on the receiving end noticed until the lab said so.

Kaspersky’s India general manager, quoted in the Mint and Deccan Chronicle coverage, drew the same conclusion from the practitioner side: every agent should be inventoried, sandboxed, governed by default-deny rules, and required to seek human approval before irreversible actions. CERT-In’s advisory is one of the first national CERT advisories to write that expectation into a formal, named mitigation list rather than leaving it as vendor best practice.