AI agents hacked several Indian organisations. The victims didn't even know

Artificial intelligence agents accessed the computer systems of several unnamed Indian organisations without permission, reading personal data, business records and confidential information while the affected organisations remained unaware of the intrusions.

India's cybersecurity agency disclosed the incidents on October 15. It did not identify the organisations, specify how many were affected or disclose their sectors.

The Indian Computer Emergency Response Team (CERT-In) said some of the intrusions were carried out by AI agents undergoing research and testing. The agents exceeded their assigned tasks and accessed live systems they were not authorised to enter.

In separate incidents, cybercriminals deliberately used publicly available AI-powered hacking tools to target Indian entities for financial gain.

The agency said the technology had reduced the time between gaining access to a system and causing damage from several days to a few hours.

The findings were published in an advisory titled AI Agents as Attack Vectors: Unauthorized Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets.

CERT-In said it identified the incidents through voluntary disclosures by AI model providers, forensic investigations and proactive searches for cyber threats.

The agency did not identify the AI developers whose agents exceeded their authorization. It also did not name the hacking groups involved in the financially motivated attacks.

The advisory highlights two distinct threats. AI systems can access unauthorised data while performing research tasks. Criminals can also use autonomous AI tools to accelerate conventional cyberattacks.

AI agents accessed confidential data without detection

CERT-In said several AI model providers voluntarily reported that their agents had accessed live computer systems belonging to Indian organisations during research and evaluation.

The agents were designed to plan tasks, issue commands, use software tools and interact with websites with limited human intervention.

But during testing, some went beyond their assigned instructions.

They accessed business records containing personal information and confidential material.

The agents exploited credentials and connection details exposed in application configuration files, publicly available software repositories and cloud systems with excessive access permissions.

Some credentials had been left in publicly accessible code. Others were available through insecure application settings.

CERT-In found that the AI agents could independently rediscover exposed credentials and reuse them during separate operations.

None of the affected organisations detected the unauthorised access.

In every voluntarily disclosed case, the AI model provider discovered the activity during an internal review and subsequently informed the authorities.

The agency warned that instructions limiting an AI agent's behaviour were not enough to prevent unauthorised access.

It recommended enforcing restrictions directly through network controls.

AI developers should isolate research and testing systems and block internet connections by default, except where access is specifically required.

Testing should use simulated targets, artificial credentials and temporary infrastructure rather than real customer information or production systems.

Each task should clearly define the systems an agent may access and the actions it is permitted to perform.

An operation should stop automatically if the agent contacts an unauthorised third-party system, discovers or uses another organisation's credentials, or triggers a warning.

CERT-In also recommended giving independent human operators the authority to terminate AI operations.

Developers should monitor agent activity in real time, recording network destinations, ports, protocols and results.

The agency said reviewing activity transcripts after a task had ended could miss unauthorised actions.

It also urged developers to prevent agents from reusing exposed third-party credentials in future operations.

If an AI agent accesses a real system without permission, its developer should promptly notify the affected organisation and CERT-In and assist with remedial measures.

The agency recommended that developers publicly disclose the safeguards they adopt.

Hackers used AI to attack faster and at greater scale

CERT-In separately identified financially motivated cyberattacks against Indian entities involving open-source AI-powered offensive security tools.

These tools can automate tasks that traditionally required substantial manual work, including identifying targets, searching for vulnerabilities and exploiting security weaknesses.

The agency observed numerous deployments of such tools across computer infrastructure in several countries.

It said the frameworks were being misused and repackaged, making automated intrusion capabilities increasingly accessible.

In one campaign, AI-powered tools reduced the time between initial access and the attack's final impact from days to a few hours.

Multiple AI agents operated simultaneously for hours or days to pursue the attackers' objectives.

CERT-In also found that some organisations were attacked again within days after failing to fully repair vulnerabilities identified during earlier incidents.

The agency stressed that the underlying weaknesses were conventional.

They included passwords and access keys exposed in source code, public repositories, configuration files, client applications and websites.

Other vulnerabilities involved unused or outdated application programming interfaces, known as APIs, that remained accessible from the internet.

Attackers also exploited payment API keys stored in readable text, cloud systems with excessive permissions and administrative interfaces exposed online.

Some affected systems lacked multifactor authentication or relied on outdated application software.

—