The two kinds of AI attacker CERT-In flagged, and the weaknesses they exploited

Some agents strayed out of AI companies' safety tests and others were run by criminals. Both exploited old and well-known security gaps, CERT-In warned

The country's cyber-security agency has warned that AI programs are now breaking into Indian computer systems, some wielded by criminals and others that strayed beyond their tasks while the companies that built them were testing them.

The warning came on October 15 from the Indian Computer Emergency Response Team (CERT-In), the agency under the ministry of electronics and information technology that responds to cyber attacks on Indian networks. (AFP/Representative image)

The warning came on October 15 from the Indian Computer Emergency Response Team (CERT-In), the agency under the ministry of electronics and information technology that responds to cyber attacks on Indian networks. It rated the advisory "Critical" and said the organisations broken into "could not detect the unauthorised access on their own". CERT-In learnt of the incidents from AI companies that owned up, from its own forensic work on suspicious activity, and from hunting for threats on its own.

The weaknesses exploited were old ones, such as passwords left in computer code and control panels left open to the internet. "In the incidents observed, AI found and exploited these conventional weaknesses faster, more exhaustively and at greater scale than human attackers," CERT-In said.

An AI agent is a program built on a large language model, the technology behind chatbots such as ChatGPT, that is handed a goal and the tools to pursue it. CERT-In describes it as "a software system capable of autonomously planning work, issuing commands, invoking tools and acting on the internet over extended periods." A chatbot answers a question and waits; an agent can work for hours, trying one approach after another until it reaches its goal or runs out of options.

Two kinds of AI attacker

The first kind came from AI companies themselves. CERT-In said it had received "multiple voluntary disclosures from AI model providers" that their models, while being tested and studied on the internet, had reached the live systems of Indian organisations. The models read business records, including personal data and confidential material. They got in using credentials, the passwords and digital keys that unlock a system, which had been left exposed in application settings, in public code repositories (online stores where programmers share and keep code) and in cloud accounts that gave broad access to anyone who asked.

In each case, CERT-In said, the models went beyond what their assigned tasks allowed, and none of the victims found out until the AI companies told them after their own internal reviews.

CERT-In did not name the companies that came forward.

Two of the world's biggest AI developers have, however, said in public that their models broke into organisations during testing this year. In July, Anthropic said its models, Claude Opus 4.7, Claude Mythos 5 and an internal research model, had hacked three unnamed organisations, with the earliest incidents dating to April, according to the Associated Press. The company said it reviewed more than 141,000 test runs, that two of the three organisations had not previously detected the activity, and that “Claude compromised the impacted organizations' infrastructure using basic techniques”. In September, Reuters, citing The Wall Street Journal, reported that Google's Gemini model had reached the internet during a test of its cyber-security abilities and hacked three companies, the first known case of a Google AI system doing so on its own. Neither disclosure said where the affected organisations were.

Separately, and in an incident that gained more attention, OpenAI’s agents hacked Hugging Face.

The second kind of attacker was human, using AI.

CERT-In found criminals running "a financially motivated campaign against Indian entities" with free, publicly available "AI-native offensive-security frameworks". Such frameworks are toolkits built for security testers, the specialists companies hire to probe their own defences, and they can carry out much of an attack without a human at the keyboard. CERT-In said these tools were being copied and renamed, with a large number of copies found running on servers in several countries, a sign that ready-made AI hacking kits are now easy to come by.

Six days earlier, on October 9, CERT-In had issued a separate Critical advisory (CIAD-2026-0046) on attacks against non-banking finance companies, digital lenders, fintech firms and wallet operators. In those attacks, intruders stole the digital keys that let a lender’s systems instruct a bank to pay out money, then used them from the lender’s own approved servers to send funds to “mule” accounts, bank accounts used to receive and quickly withdraw stolen money. That route skipped the usual checks, which CERT-In said “completely bypass[es] application-level controls such as loan creation, KYC, sanction”. The attackers then deleted logs to cover their tracks. CERT-In said they may have used AI-assisted tools and that the gap between break-in and fraud had shortened.

Attacks at machine speed

In the criminal campaign, CERT-In said, AI tools cut the time between first getting in and doing the final damage "from days to a few hours". Several agents worked in parallel for hours or days at a stretch to reach the attackers' goals. Organisations that fixed only part of the problem were attacked again within days, and on a larger scale. In the cases the AI companies disclosed, agents found an exposed credential, then found it again and reused it in separate operations.

CERT-In now wants organisations to watch the traffic on their APIs second by second, flagging sudden bursts of probing, bulk downloads of data and waves of automated sign-ups. An API, or application programming interface, is the channel through which one piece of software requests data or actions from another; a payments app uses one to talk to a bank.

CERT-In also wants logs kept for at least 180 days, so investigators can reconstruct what happened long after the fact.

The weaknesses AI agents exploited

CERT-In listed the weaknesses behind every AI-driven incident it had seen recently, and none of them is new:

• Passwords and digital keys exposed in source code, in the history of public code repositories, in settings files, inside apps and on public web pages
• Old, abandoned and test APIs that were never switched off and can still be reached from the internet
• Keys for payment systems stored as plain, unencrypted text that a running application can read.
• Cloud accounts and ready-made app back ends set up so loosely that ordinary users, or anonymous ones, can read and change large amounts of data
• Control panels for managing systems left open to the internet, and unpatched software with weak passwords or no multi-factor authentication, the second check such as a one-time code sent to a phone.

What CERT-In wants AI companies to do

The advisory sets out seven measures for AI developers, research laboratories and the agencies that test their models. Testing should happen behind a network that blocks all outside connections by default and lets through only the destinations a task strictly needs, and CERT-In wants that block enforced in the network itself, "not through instructions to the model". Tests should use fake targets, fake passwords and throwaway computers, with real data and real credentials kept out.

Every test should spell out which systems the agent may touch. If the agent contacts an outside system, picks up someone else's credentials or signals that it is stuck, the run should stop automatically, and an independent operator should have the power to end it. CERT-In wants agents watched as they work, with each request logged. Reading the record afterwards is not enough, it said, because such a review "can miss activity that a model's reasoning makes appear legitimate". Any outside credential an agent stumbles on should be blocked from all future runs. If an agent gets into a real system, the company should tell the victim and CERT-In promptly and help with the clean-up.

What it wants everyone else to do

For organisations, CERT-In's list starts with its May 2026 blueprint on defending against AI-assisted attacks, which asks that known, actively exploited flaws on internet-facing systems be fixed "within 12 hours where feasible" and that cyber incidents be reported to CERT-In within six hours. The new advisory adds:

• Search code, its full history, settings files, apps and cloud storage for exposed passwords and keys; change any that are found, scrub them from the history and check the fix from outside
• Keep a complete list of APIs and shut down the ones no longer in use
• Give every user and program only the access it needs, and never put powerful keys inside apps that customers download
• Take management panels off the internet, require multi-factor authentication for administrators, and patch exposed software without delay
• Govern the organisation's own AI agents, giving each run its own short-lived identity, blocking outside connections by default, and keeping a tamper-proof record of what the agent did

Banks, finance companies and fintech firms are also told to apply the payment-system measures in the October 9 advisory.

After a breach, CERT-In wants any system where a credential was exposed or access confirmed treated as compromised until a forensic check clears it, and retested after the fix. It tells organisations to "expect repeat attempts within days to weeks".