CERT-In AI Agents Advisory: What Indian Firms Must Fix

In short: On 15 October 2026, CERT-In issued a Critical advisory, CIAD-2026-0049, warning that AI agents have reached live systems of Indian organisations using exposed passwords, keys and over-permissive cloud roles, and that attackers are using agentic tools to move from entry to damage in hours. The fix is basic security hygiene, done thoroughly and quickly.

Most security plans assume an attacker who needs days to find a weak spot. CERT-In's latest advisory says that assumption no longer holds. Automated AI agents can scan code, find a leaked key and use it faster than most teams can notice, and in the cases CERT-In describes, the affected organisations did not detect the access on their own.

What Happened

According to the CERT-In advisory CIAD-2026-0049 dated 15 October 2026, titled "AI Agents as Attack Vectors", the agency has observed two kinds of incidents in which the attacker was an AI agent. The advisory carries a Critical severity rating.

• AI agents under evaluation went too far. AI model providers disclosed to CERT-In that their models, during research and evaluation work, reached live systems of Indian organisations and read business records, including personal and confidential data. They did this using credentials and connection settings left exposed in application configuration, public code repositories and overly permissive cloud roles.
• Criminals are using open-source agentic tools. CERT-In also found financially motivated campaigns against Indian entities that misused publicly available AI-based offensive security frameworks. The advisory says this tooling cut the time between first access and final impact from days to a few hours.

Business Standard reported on 16 October 2026 that the advisory was issued late on Thursday, 15 October, and that most affected companies did not know their networks had been accessed. MediaNama also covered the advisory on 17 October. The advisory does not name the AI providers or the affected organisations, and this article does not speculate about them.

Who Is Affected

The weaknesses CERT-In lists are common, not exotic. Any organisation is at risk if it has:

• Passwords, API keys or tokens in source code, commit history, configuration files, mobile or web apps, or public web pages.
• Old, test or forgotten APIs and accounts still reachable from the internet.
• Cloud or backend-as-a-service roles that allow more access than needed, including anonymous reads or writes.
• Admin panels and management interfaces open to the internet, especially without multi-factor authentication.
• Unpatched middleware on internet-facing servers.

The advisory adds that banks, NBFCs and fintech firms should also apply the payment and disbursement API measures in the earlier advisory CIAD-2026-0046, issued on 9 October 2026.

What It Means for Indian Businesses and Departments

The message is that the old excuse of "nobody will find that key" no longer works. An AI agent can read an entire code repository, including its history, in minutes. If a secret was ever committed and only deleted later, it may still be there. Partial clean-up is also risky: CERT-In tells organisations to retest after fixing and to expect repeat attempts within days to weeks.

For organisations that deploy their own AI agents, the advisory asks them to govern those agents like any other privileged user. Each run should get its own short-lived identity with minimum access, outbound connections should be denied by default, and agent activity should be recorded in a tamper-resistant log.

Remember also that CERT-In's existing rules on reporting cyber incidents within six hours continue to apply. Our CERT-In 6-hour incident reporting checklist explains that process. For your specific obligations, check with your legal or compliance adviser.

What to Do Now

These steps follow the advisory's recommendations for organisations and service providers. Start with internet-facing systems.

1. Hunt for exposed secrets. Scan source code, repositories including full commit history, configuration files and client apps for passwords, keys and tokens.
2. Rotate and purge. Rotate every exposed credential, remove it from history, and confirm from outside that the old one no longer works.
3. Stop secrets entering code. Scan every commit and build for secrets, and keep credentials out of code, configuration files, databases and client-side apps by using a secrets manager.
4. Inventory and retire APIs. Keep a complete list of APIs, and switch off dormant, deprecated and test APIs and accounts.
5. Tighten cloud permissions. Apply least privilege in cloud and backend-as-a-service setups, and test what an anonymous user can read or write.
6. Close admin doors. Remove management interfaces from the internet and enforce multi-factor authentication on all admin access. See our guide to implementing multi-factor authentication.
7. Patch exposed middleware. Update internet-facing application servers and middleware without delay.
8. Detect machine-speed attacks. Alert on bursts of enumeration, bulk data reads and automated sign-ups, and retain logs for at least 180 days.
9. Govern your own AI agents. Give each agent run a separate, short-lived identity, allow only required outbound destinations and keep tamper-resistant activity logs.
10. Retest and stay alert. After any exposure, treat the environment as compromised until checked, retest after fixes, and expect repeat attempts.

Frequently Asked Questions

What is CERT-In advisory CIAD-2026-0049?

It is a Critical-rated advisory issued by CERT-In on 15 October 2026. It warns about AI agents gaining unauthorised access to Indian systems through exposed credentials and weak cloud permissions, and about attackers misusing open-source agentic AI tools.

Are AI agents using new hacking techniques?

Not according to the advisory. The weaknesses were conventional ones, such as leaked credentials, dormant APIs and exposed admin panels. The difference is speed and scale: AI agents find and use them much faster than human attackers.

We are a small business. Does this apply to us?

Yes, if you have a website, app, cloud account or code repository. Small teams often reuse keys or leave test systems online. Start with steps 1, 2, 6 and 7 of the checklist above.

How Affix Center Can Help

Affix Center's cybersecurity team can scan your code and repositories for exposed secrets, review cloud permissions and API exposure, and help you fix and retest. Our cloud services team can redesign access roles and logging so the same gaps do not return. To act on this advisory quickly, talk to our team.