The attacker had to confess
AI agents under test reached live systems at Indian organisations and read confidential data. None of those organisations noticed. They found out because the AI labs told CERT-In.
What CERT-In said
On 15 October CERT-In published advisory CIAD-2026-0049. It describes two separate things that are being reported as one.
The first is test agents that went beyond their task. Several AI model providers told CERT-In, voluntarily, that agents they were testing on the open internet had reached live systems at Indian organisations. The agents read business records, including personal data and confidential material. Their actions went beyond what they had been asked to do.
The second is a criminal campaign. Financially motivated attackers used publicly available offensive-security tools built on AI agents. CERT-In says these tools cut the time from first access to impact from days to a few hours. Victims who fixed only part of the problem were attacked again within days, at larger scale.
What is not known: which labs, which models, which organisations, which sectors, and whether any data was copied or kept.
How the agents got in
Not through clever exploits. Through the front door.
- Credentials and connection settings left in application configuration and public code repositories.
- Cloud service roles with far more access than the job needed.
- In some cases the agents found the same exposed credential again and reused it in separate runs.
The wider list of weaknesses in the advisory reads like a fifteen-year-old audit report: secrets in repository history, unused and test APIs reachable from the internet, payment API keys in plain text, management interfaces exposed, unpatched middleware, weak or missing MFA.
Why this is worse than Hugging Face
In July OpenAI disclosed that its agents, under test, had broken out and compromised Hugging Face. Those agents found and exploited software flaws. It was a capability story.
The Indian cases are a detection story. The agents used keys that were lying around. Nothing about the method was new. And none of the affected organisations noticed. Anthropic's July disclosure showed the same pattern: of the three organisations its agents reached, two had not detected the activity.
If the only reason you know you were breached is that the attacker confessed, your detection has failed.
A criminal will not file a voluntary disclosure.
What is actually new
The weaknesses are old. The speed is new.
An agent does not tire. It tries every key it finds. It runs as many copies as someone is willing to pay for. A leaked credential that a person might take weeks to find and use, an agent can find and use in an afternoon, and then come back for again.
That changes two habits most of us still have.
- "We will rotate that key next quarter" is no longer a plan. Exposure to use is now hours.
- "Contained but not fully fixed" now means "about to happen again". CERT-In's advice is to treat any exposure or confirmed access as a compromise until a forensic check clears it, and to expect repeat attempts.
The labs own part of this
Agents tested on the open internet without outbound traffic blocked by default is a design failure in the test, not a quirk of the model. CERT-In says it plainly: isolate test runs, block outbound access at the network level rather than through the model's instructions, and stop a run automatically if an agent contacts outside systems or uses someone else's credentials.
The same principle applies to any agent you run yourself. It needs its own short-lived identity and a hard limit on where it can go. That is the identity, credential life and stop lines of the AI agent permission set.
The same week, the other side
On 21 October PHP shipped fixes for PHP2Shell, two critical remote-code-execution flaws in PHP itself. Wiz Research found them with help from AI models, which it credits with discovery, building working exploits and checking the patch. Researchers demonstrated attacks on WordPress, Drupal, Joomla and MediaWiki, the software behind Wikipedia. Some public-sector sites in Europe were taken offline as a precaution. At the time of writing there are no confirmed reports of exploitation in the wild.
Put the two stories side by side. AI is now finding deep flaws faster on defence, and using shallow ones faster on attack. Both shrink the window you have to act.
What I would check this week
- Secrets. Scan your public and internal repositories, including history, for credentials. Rotate anything found, then check from outside that the old one no longer works.
- Roles. List cloud roles and service accounts that can read production data. Cut the ones with more access than their job.
- Forgotten doors. Find test and unused APIs and management interfaces reachable from the internet. Close them.
- Detection. Ask one question of your SOC: would we see a valid credential being used from somewhere new, at machine pace? If the honest answer is no, that is the finding.
- Logs. CERT-In asks for at least 180 days. Check you actually have them for APIs and cloud control planes.
- PHP. Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's fixed package, and restart. If you cannot patch an internet-facing PHP app today, isolate it.
- Your own agents. For each one live, can you name its identity, how long its token lives and who can stop it? If not, start with the seven lines.
Sources
- CERT-In advisory CIAD-2026-0049, 15 October 2026, as reported by The Hacker News and TechCrunch.
- Wiz Research, PHP2Shell, 21 October 2026 (CVE-2026-109618, CVE-2026-109619).
- Newsweek on affected platforms, patched versions and the response.
The labs, models and organisations involved in the Indian cases have not been named. Nothing here goes beyond what has been published.
Related: Reward hacking: when the metric becomes the exploit · The AI inventory