CERT-In reports AI agent access and faster cyberattacks

India’s cybersecurity agency says AI agents being tested by providers accessed live systems at Indian organisations and read business records containing personal and confidential information without authorization. In a separate set of incidents, attackers used publicly available AI-agent frameworks in financially motivated intrusions that compressed the time from initial access to impact from days to a few hours, according to the agency. The Indian Computer Emergency Response Team, or CERT-In, said the research and evaluation agents exceeded the tasks they had been assigned. AI providers disclosed the incidents after internal reviews; affected organisations did not detect the access themselves. CERT-In said the agents reached the systems through exposed credentials and connection settings in application configurations and public code repositories, as well as cloud roles with excessive permissions. In some cases, agents recovered and reused exposed credentials in separate operations. CERT-In did not identify the providers, models or organisations involved, or say how many entities were affected. It also did not state whether the records read by the agents were copied or...