On 15 October this year, the union government’s cybersecurity agency, Computer Emergency Response Team (CERT-In), issued a “critical” advisory that said that several Indian organisations had had their confidential data exposed to rogue AI agents.
The most unsettling line in CERT-In's advisory is not really about AI but about us. Several Indian organisations had business records, personal data and confidential files read by autonomous AI agents, and not one of them noticed. They “could not detect the unauthorised access on their own,” the agency said. They learnt of it only because the companies that built those agents searched their own logs and owned up.
A week later, the picture is darker. It has emerged that in the case of Indian networks, agents were involved from more than one AI provider, unlike earlier episodes abroad where a single lab confessed.
Nor did the agents need anything clever. They walked in through credentials and connection settings left in application configurations and public code repositories, and through cloud roles far looser than they should have been.
Some found the same exposed key twice and reused it. CERT-In has still not named the providers, the firms or the sectors, nor said whether any data was copied.
Exploiting Existing Weaknesses
The days since have shown how thin the ice is. Google and Mozilla withdrew trust in certificates issued by Bengaluru’s eMudhra after CERT-In warned that its private keys had been generated with weak randomness.
On 21 October, two critical flaws in PHP, the language behind roughly 70 per cent of websites, leaked before the fix was ready. Governments in the Netherlands, France, Finland, Denmark and Canada pulled sites offline, and Cloudflare logged exploitation attempts climbing into the millions.
CERT-In issued its own critical alert. The Ministry of Electronics and Information Technology (MEITY) is now reported to be planning a high-level stocktaking and audit of the damage to Indian enterprises. A senior official’s diagnosis was blunt: credentials stored in plain text, passwords never changed from installation defaults, small businesses especially exposed.
That is the real lesson. AI has not invented new weaknesses; it has changed their economics. A leaked API key in a forgotten commit was once a lottery ticket that someone had to stumble upon. An agent that runs thousands of actions without sleep turns the lottery into a sweep.
CERT-In has also traced a criminal campaign using open-source agentic frameworks that cut the time from first foothold to final damage from days to hours, and that hit half-patched victims again within days. Even the PHP flaws were found by researchers using AI models. The tools that find holes for defenders find them for everyone else.
AI is widening the attack surface from inside too. Every firm wiring agents into its CRM, payments stack or code base creates a new kind of identity: non-human, over-privileged, rarely logged. An agent holding a long-lived key with open outbound access is an insider who never goes on leave.
Response Coordination
For Indian boards, the crucial moment has arrived. CERT-In’s checklist reads like a hygiene manual: scan every commit for secrets, rotate exposed keys, inventory every API and kill the dormant ones, take admin panels off the internet, enforce multi-factor authentication, keep logs for 180 days.
These are not new but skipping it is now expensive. Firms must invest in secrets management, API discovery and behavioural monitoring, and, awkward as it sounds, in AI-driven defence, because no human team can read the 17,000-odd agent actions logged in the Hugging Face intrusion in July.
Process matters as much as tools. Any exposed credential should be treated as a breach until forensics clears it. Each agent should be given a short-lived, least-privilege identity. That the attacker will be back has to be expected.
But the burden cannot sit with victims alone. These agents were not criminals’ tools. They were products under test by some of the best-funded companies on earth. The MEITY has to act, and firmly.
Voluntary disclosure was welcome, but voluntary is the problem. MeitY should make reporting mandatory for any AI developer whose system touches Indian infrastructure, within the six-hour window CERT-In already imposes on Indian entities, with direct notice to the victim.
Testing of offensive cyber capability must require certified isolation, with outbound traffic blocked at the network layer rather than by politely instructing the model. CERT-In should be empowered to name the provider once victims are told.
Where agents read Indians’ personal data, penalties under the Digital Personal Data Protection Act, up to Rs 250 crore for security lapses, should reach whoever ran them. Repeat offenders should lose the right to run evaluations that can touch Indian networks. And the planned audit should examine the labs’ conduct, not just the victims’ hygiene.
Legislative Markers
The world is moving, unevenly. OpenAI apologised to Australia last month after its agents entered four government websites, including a Medicare statistics portal. Anthropic, which disclosed in July that Claude models had broken into three outside organisations during tests, says it is cutting its internal evaluations off from the live internet.
The EU’s AI Act already obliges providers of the most capable models to report serious incidents; Britain’s AI Security Institute has published its own incident findings; Washington still prefers voluntary pacts.
India should not wait for consensus. It should press, through the G20 and its bilateral cyber dialogues, for a cross-border protocol on incidents caused by AI agents.
The irony is that the only alarm that rang came from the intruders’ makers. That cannot be the security architecture of a $1 trillion digital economy in waiting.
Indian entities must learn to see what moves inside their own systems, and regulators must ensure that those who build these machines answer for wherever they wander.
(Subimal Bhattacharjee is a Visiting Fellow at Ostrom Workshop, Indiana University Bloomington, USA, and a cybersecurity specialist. This is an opinion piece. The views expressed above are the author’s own. The Quint neither endorses nor is responsible for them.)