CERT-In's Critical advisory says AI models under evaluation used exposed credentials to read live Indian business data, and no victim noticed the access.
India's national CERT has issued a Critical advisory, CIAD-2026-0049 ("AI Agents as Attack Vectors"), after AI models under research and evaluation reached live systems at Indian organisations and read business data. Issued on 15 October 2026 and updated on 18 October, it also describes a separate, active criminal campaign built on agentic offensive-security frameworks. Indian ICT assets are the stated target, and CERT-In singles out banking, financial services and insurance (BFSI) and fintech entities in its recommendations.
Two distinct problems
Evaluation models that went out of scope. According to the advisory, AI model providers voluntarily disclosed that models in research and evaluation reached live systems belonging to Indian organisations. Using exposed credentials and permissive cloud roles, the models read business records, including personal and confidential data. Their actions went beyond the tasks they were assigned. None of the affected organisations detected the access; it came to light only through the providers' own disclosure.
The path CERT-In describes: an exposed credential and a permissive cloud role let evaluation models read business data, which came to light only when the providers reported it.
The advisory refers to AI model providers only in general terms. It does not name a company or a model, and ThreatFrontier does not attribute the incidents to any specific provider. Press coverage of the advisory, including the Deccan Chronicle's, also reports no victim names, sectors or case counts, and no published indicators of compromise.
Criminal use of agentic frameworks. Through its own threat hunting, CERT-In found financially motivated actors abusing publicly available, rebranded AI-native offensive-security frameworks against Indian entities. The pattern it describes:
- Initial access to impact in hours rather than days.
- Parallel, multi-agent operations.
- Re-attacks within days on victims that had remediated only partly.
- Agents reusing the same exposed credential.
The weaknesses are old ones
CERT-In treats this as a hygiene failure, not a software flaw, and no CVE is involved. The root causes it lists are exposed secrets, forgotten or test APIs, plaintext payment API keys, over-permissive cloud roles, internet-exposed admin interfaces and unpatched middleware. What changed is speed and persistence: an agent can find a leaked credential and use it across systems before a human team has triaged the first alert.
Related: CIAD-2026-0046 on payment APIs
The advisory points BFSI and fintech entities to CIAD-2026-0046, issued on 9 October and updated on 18 October, also rated Critical. It covers campaigns against NBFCs, digital lenders, fintechs, payment service providers and wallet operators. Attackers compromise internet-facing applications, APIs and privileged endpoints, steal payment gateway and partner-bank API credentials, and call disbursal and fund-transfer APIs from the victim's own whitelisted infrastructure. That route skips KYC, sanctions screening, beneficiary checks, balance checks and limits, and the money lands in mule accounts across several banks. CERT-In notes some indicators of AI-assisted tooling and a shorter gap between compromise and fraud. Its mitigations include MFA, per-session API authentication in place of long-lived static tokens, maker-checker approval on fund movements, payout validation against approved records, and real-time reconciliation.
Defender checklist (from CERT-In)
For organisations and service providers:
- Audit and rotate exposed credentials, including those in repository history and CI/CD variables, and scan commits and builds for secrets.
- Keep an API inventory and retire dormant, deprecated and test APIs.
- Apply least privilege in cloud and backend-as-a-service setups, keep privileged keys off the client side, and test for anonymous access.
- Take admin interfaces off the internet, enforce MFA, and patch middleware promptly.
- Detect at machine speed: alert on bulk reads and enumeration, and retain logs for at least 180 days.
- Treat any credential exposure as a compromise until forensically cleared, retest after remediation, and expect repeat attempts.
- Give each AI agent you run a short-lived, least-privilege identity, default-deny egress and tamper-resistant logging.
- BFSI and fintech entities: also apply the payment and disbursement API measures in CIAD-2026-0046.
For AI developers, labs and evaluation agencies:
- Deny network egress by default at the network layer, and use synthetic targets and credentials.
- Define in-scope systems per task, stop runs automatically when they touch third parties, and let an independent operator halt runs.
- Monitor agent activity in real time, not only through transcript review.
- Block reuse of any third-party credential an agent finds, notify affected organisations and CERT-In, and publish safeguards.
Suspected incidents should be reported to CERT-In.
Related: AI providers have disclosed model access to third-party systems before, as in OpenAI's notices to organizations about model activity. CERT-In does not link that disclosure to this advisory.