CERT‑In issued a critical advisory Thursday after discovering that AI agents accessed live systems of Indian organisations, reading business records, personal information and confidential data without detection.
The revelations came when AI model providers disclosed that their test agents had infiltrated corporate networks, exploiting exposed credentials, poorly secured APIs and excessive cloud permissions that were not aligned with the principle of least privilege.
Jaydeep Singh, general manager India at Kaspersky, warned that conventional cyber‑defence tools are ill‑suited to counter autonomous systems that operate with legitimate credentials, noting the risk grows as AI agents connect to emails, code repositories and cloud services.
Sunil Sharma, managing director of Sophos India, added that the rapid autonomy of these agents means an attacker can invoke APIs and interact with internal systems, shortening the window from days to hours between intrusion and damage, a trend already manifest in financially motivated attacks.
CERT‑In is urging companies to conduct immediate audits of credentials, tighten API security, enforce strict authentication and adopt zero‑trust principles, with a follow‑up briefing scheduled for next week.