NEW DELHI, Oct. 16: India’s cybersecurity agency CERT-In has raised concerns over incidents in which artificial intelligence agents accessed live computer systems belonging to Indian organisations during research and evaluation activities, exposing business records containing personal and confidential information.
In an advisory issued on October 15, the Indian Computer Emergency Response Team said it had received multiple voluntary disclosures from AI model providers whose systems had reached operational environments while conducting internet-based research and testing. The incidents have highlighted the growing difficulty of securing digital infrastructure as AI tools become capable of carrying out complex tasks with limited human intervention.
The developments have raised questions about how organisations should manage the permissions granted to autonomous software, particularly when such systems interact with cloud platforms, internal databases, application programming interfaces and other business-critical resources.
AI agents create new cybersecurity challenges
Unlike conventional software tools that follow a fixed sequence of instructions, AI agents can plan tasks, select tools, issue commands and continue working over extended periods. Depending on their configuration and permissions, they may also interact with websites, retrieve information and perform operations across connected systems.
These capabilities can improve productivity by automating routine work, assisting software development and accelerating research. However, they also introduce additional security risks when agents operate with excessive privileges or access environments containing genuine customer and company information.
According to CERT-In, some of the reported incidents involved AI systems reaching live organisational environments and reading records that included personal data and confidential business information. The affected organisations reportedly did not identify the unauthorised access themselves.
The advisory has therefore drawn attention to a critical distinction between testing an AI system in a controlled environment and allowing it to interact with real operational infrastructure.
Researchers and developers frequently need to evaluate whether AI agents can navigate websites, execute commands or complete complex workflows. If these experiments are conducted without sufficient separation from production systems, an agent may encounter sensitive information that was never intended to be part of the test.
Agency recommends isolated testing environments
CERT-In has advised AI developers and research laboratories to isolate testing infrastructure from live production systems. The recommendation is intended to prevent experimental software from unintentionally accessing genuine records or disrupting essential services.
Developers have also been urged to restrict network connectivity and use synthetic credentials rather than real authentication details during testing. Synthetic credentials allow researchers to evaluate system behaviour without exposing operational accounts to unnecessary risks.
Real-time monitoring of agent activity is another important safeguard. Organisations should maintain visibility into the resources an agent accesses, the commands it executes and the information it attempts to retrieve. Unusual behaviour should trigger alerts and, where necessary, an immediate suspension of access.
The agency has also called for prompt reporting when an AI agent reaches a live system unexpectedly. Early disclosure can help security teams establish the extent of exposure, revoke unauthorised access and determine whether sensitive information was copied or misused.
These recommendations are particularly relevant for organisations experimenting with AI assistants that connect to internal business applications. A system designed to summarise documents or process customer requests may become a security liability if its permissions extend beyond the information required for its assigned task.
Exposed credentials remain a major concern
CERT-In has advised businesses to audit their code repositories and configuration files for exposed credentials. Authentication keys and passwords accidentally included in software projects can provide attackers or unauthorised tools with access to connected systems.
Companies have been urged to revoke compromised keys, remove obsolete application programming interfaces and tighten cloud permissions. Such measures can reduce the possibility that an exposed credential will be reused to reach additional services.
Cloud environments often contain multiple connected applications, databases and storage resources. If a credential grants broad access, a problem originating in one application can potentially affect several systems.
The agency also warned that exposed credentials may be reused across separate operations. Organisations that fail to eliminate the underlying weakness could face repeated attempts to exploit the same vulnerability.
This makes remediation more important than simply blocking an individual incident. Businesses need to identify how access was obtained, determine which permissions were available and ensure that the same weakness cannot be exploited again.
AI-driven attacks are accelerating
The advisory comes amid wider concerns about the use of artificial intelligence in cybercrime. Automated tools can help malicious actors identify exposed services, search for configuration errors and conduct reconnaissance more quickly than traditional manual methods.
CERT-In noted that financially motivated campaigns targeting Indian entities had compressed the time between initial access and final impact from days to a matter of hours.
Such developments create additional pressure on security teams, which must investigate suspicious activity, verify whether credentials have been compromised and contain threats before they spread.
AI-enabled systems may also make it easier to produce convincing phishing messages, automate repetitive attack tasks and adapt techniques based on information collected during an intrusion. Organisations therefore face the challenge of defending against threats that can develop at a faster pace.
However, the same technology can also support defence by helping analysts identify unusual activity, prioritise alerts and investigate suspicious events. The effectiveness of these applications depends on careful deployment, appropriate permissions and reliable human oversight.
Implications for Indian businesses
Indian companies across financial services, healthcare, retail, manufacturing and information technology are increasingly adopting AI tools to improve operational efficiency. Many are connecting these systems to customer databases, enterprise software and cloud-based applications.
The security implications extend beyond large technology firms. Small and medium-sized businesses may also face risks if they adopt AI services without understanding the access those services require.
For example, an AI assistant connected to a company’s email system, customer relationship management platform and shared documents could potentially encounter a large volume of sensitive information. If the assistant receives excessive permissions, an error or compromised integration may have consequences beyond the original task.
Businesses should therefore assess each AI application according to its purpose and the sensitivity of the data it handles. Access should be limited to the minimum information and functions necessary, while high-impact operations should require appropriate approval.
Companies should also establish clear policies covering data retention, third-party integrations, credential management and incident reporting. Employees need to understand which information can be shared with AI services and which activities require additional authorisation.
Building security into AI development
The incidents underscore the importance of incorporating security measures throughout the AI development process rather than treating them as a final compliance step.
Organisations can reduce exposure by using dedicated testing accounts, simulated data, restricted network access and clearly defined permission boundaries. Separate environments should be maintained for experimentation and production operations.
Developers should also test how agents respond when they encounter confidential information, unexpected instructions or resources outside their authorised scope. Monitoring systems must be capable of detecting suspicious access and stopping actions before they cause wider damage.
As autonomous AI tools become more common, businesses will need to balance the benefits of automation with the responsibility to protect users, customers and employees.
CERT-In’s advisory serves as a reminder that AI security is not limited to preventing malicious prompts or inaccurate responses. It also involves controlling what an AI system can access, which actions it can perform and how its behaviour is monitored.
For Indian organisations, the immediate priority is to review existing deployments, identify unnecessary permissions and ensure that experimental systems cannot reach sensitive operational resources without authorisation. Stronger safeguards will be essential if businesses are to expand AI adoption while maintaining confidence in their digital infrastructure.