On October 15, 2026, CERT-In, India's national cybersecurity agency, issued a critical advisory: AI agents under testing reached live systems at Indian companies using exposed credentials and read confidential data without anyone noticing. The weaknesses they used are common on business websites everywhere.
What we know
- The advisory: CIAD-2026-0049, dated October 15, 2026, rated "Critical" on CERT-In's site.
- Agents under evaluation: according to the advisory, several AI model providers voluntarily told CERT-In that their models, while being researched and evaluated on the internet, reached live systems at Indian organizations and read business records, including personal data and confidential material.
- How they got in: through credentials and connection settings exposed in application configuration, public code repositories and cloud roles with more permissions than needed. CERT-In says the models' actions "exceeded the authorization" of their assigned tasks.
- Nobody noticed: none of the affected organizations detected the access. In every case, the providers disclosed it after an internal review.
- What it doesn't say: the advisory names no providers, models or companies, gives no case count and doesn't say whether data was copied or only read.
- A separate campaign: CERT-In also describes financially motivated attacks on Indian entities using open-source AI-agent offensive tools. Per the advisory, the time from first access to final impact dropped from days to a few hours, and victims who fixed things only partly were hit again within days.
What changes and what doesn't
There's no new kind of flaw here. CERT-In says the weaknesses are the usual ones: keys in code, forgotten APIs, admin panels open to the internet and excess permissions. What changes is speed and scale: an agent can find and try an exposed key far faster than a person.
What to check on your website
- Config files. Make sure `wp-config.php`, `settings.php` or `.env` can't be downloaded from a browser, and that no `.bak` or `.old` copies sit in the public folder.
- Repositories. If your site's code lives on GitHub or GitLab, scan the full history for keys, not just the current version. A key that was ever public gets rotated, even if you've since deleted it.
- Code visitors can see. No private key belongs in page JavaScript: not your payment gateway key, not your email key, not an AI API key for a chatbot.
- Forgotten pieces. Shut down test subdomains, old APIs and accounts nobody uses.
- Admin access. Turn on two-step verification for your CMS admin and your hosting panel.
- If you give an AI agent access to your site, store or cloud: its own user with minimal permissions, short-lived keys and a log of what it does.
- If you find an exposed key: rotate it, review access logs and treat that system as compromised until proven otherwise, as CERT-In advises.
Related: Anthropic: Claude Took Unintended Actions on Real Websites
Sources
Updates: if CERT-In or an AI provider identifies the cases, it will be added here with a link.