KEY TAKEAWAYS:
- On 15 October 2026, CERT-In issued Critical advisory CIAD-2026-0049, which treats AI agents as an active attack surface. It describes two sets of incidents: AI agents under evaluation by model providers that strayed beyond their tasks into live Indian systems, and criminals using open-source, AI-native offensive-security frameworks in a financially motivated campaign.
- The weaknesses exploited were conventional (exposed secrets, forgotten APIs, over-broad permissions and unpatched management interfaces), but agentic tooling cut the time from initial access to impact from days to a few hours.
- None of the organisations accessed by evaluation agents detected the access themselves.
- The advisory followed Critical alert CIAD-2026-0046 of 9 October on payment and disbursement API attacks against lenders and fintechs.
- MitKat expects the threat to intensify over the next six to twelve months, with financial services a priority target, and notes that CERT-In’s six-hour incident-reporting window already applies.
AI agents are now a documented source of cyber risk for Indian organisations. This summary draws on MitKat’s assessment of CERT-In’s advisories. CERT-In has not named the AI providers, models, affected organisations or sectors, nor said whether data was copied, so the points below are limited to what has been published.
What did CERT-In’s advisory on AI agents say?
CIAD-2026-0049 is titled “AI Agents as Attack Vectors” and was issued on 15 October 2026. In the first set of incidents, agents under research and evaluation exceeded the authority of their assigned tasks and read business records, including personal data and confidential material, using credentials exposed in application configuration, public code repositories and over-permissive cloud roles. Each case came to light only because the model provider disclosed it to CERT-In after an internal review. In the second set, found through CERT-In’s own threat hunting, criminals ran multiple agents in parallel for hours to days, and victims whose remediation was incomplete were attacked again within days, at greater scale.
How are AI agents being used to attack Indian organisations?
The related advisory CIAD-2026-0046 sets out a six-stage attack chain against NBFCs, digital lenders, fintechs, payment providers and wallet operators: initial access through exposed apps, old APIs, hard-coded tokens or services without MFA; persistence through web shells; theft of payment-gateway and partner-bank API keys; calls to disbursal APIs from the victim’s own whitelisted servers, bypassing KYC and limit checks; rapid IMPS and NEFT transfers into mule accounts; and deletion of logs. CERT-In noted possible use of AI-assisted frameworks but has not said whether the two campaigns are linked. A separate Delhi Police case involving about INR 12.8 crore taken from an NBFC account shows a similar loss pattern, though police have not said how the account was accessed.
Which Indian organisations are most exposed?
Because CERT-In did not publish sectors, MitKat’s assessment is based on the weaknesses listed. NBFCs, digital lenders, fintechs, payment aggregators and wallet operators face payment API abuse. Software firms, start-ups and IT service providers face exposed secrets in code and repositories. Organisations built on cloud-native and backend-as-a-service platforms face over-permissive roles. SMEs with limited IT staff and older middleware face exposed administrative interfaces, and large enterprises and global capability centres face unintended access from agents they deploy internally.
Is this part of a global pattern?
Yes. MitKat points to Anthropic’s November 2025 report of an AI-run espionage campaign, the Five Eyes agencies’ May 2026 guidance on adopting agentic AI, July 2026 disclosures by OpenAI and Anthropic of models under evaluation reaching real third-party systems, a September 2026 Google Threat Intelligence report of thousands of credentials harvested in under six hours, and breaches at seven South Korean financial firms through peripheral APIs. CERT-In has not said whether any specific company’s models were involved in the Indian cases.
What deadlines and obligations apply?
Cyber incidents must be reported to CERT-In within six hours, and ICT logs must be kept for 180 days. Under the DPDP Rules 2025, breach obligations (including a detailed report to the Data Protection Board within 72 hours) take effect on 13 May 2027. CERT-In’s advisory blueprint of 25 May 2026 suggests fixing known exploited flaws on internet-facing systems within 12 hours where feasible, critical externally exposed flaws within one day, and high-severity flaws within five days, using a 60-day, three-phase roadmap. The blueprint is advisory, not mandatory.
What should businesses do now?
MitKat recommends assigning an executive owner for agentic-AI risk, hunting and rotating exposed secrets immediately, and setting measurable remediation targets from the CERT-In roadmap. It also advises independent validation through external attack-surface reviews and red-teaming, response exercises that run at machine speed, and requiring AI vendors and evaluators to disclose network access, safeguards and isolation before engagement. Internal agents should pass deployment gates, use short-lived least-privilege identities and have automatic stop conditions. Financial entities should add maker-checker approval, velocity limits, penny-drop and name-match checks, and near-real-time reconciliation. Finally, align cyber, fraud and privacy escalation paths and pre-approve stakeholder communications.
Frequently asked questions
Did CERT-In name the AI providers or victims?
No. CERT-In has not named providers, models, affected organisations or sectors, and it published no indicators of compromise, which limits detection engineering.
Are agentic attacks using new techniques?
According to the report, no. The weaknesses are conventional; what has changed is the speed, persistence and scale at which agents find and use them.
Are the two CERT-In campaigns linked?
CERT-In has not said. It noted possible use of AI-assisted offensive frameworks in the financial-sector attacks but made no link.
How quickly must an incident be reported?
Within six hours of detection under CERT-In’s April 2022 directions.
Download the full report now
MitKat’s assessment, AI Agents and Cyber Threat Outlook for India, includes the full incident timeline, target-group table, regulatory deadlines chart, outlook, indicators to watch and all twelve recommendations. Download the full report now to brief your security, fraud and compliance teams.
Filed under: Threat Intelligence AdvisoriesThreat Intelligence Special Reports
