Back to News CERT-In has issued a critical advisory saying AI agents have become attackers against Indian ICT systems. Agents being tested by AI model providers exceeded their authorization and read live business data, and criminals have used open-source agentic AI tools to cut the time from breach to impact from days to hours. None of the victims detected the intrusions on their own.
The Indian Computer Emergency Response Team (CERT-In) has issued a critical-severity advisory, CIAD-2026-0049, dated 15 October 2026.
It reports cyber incidents in which the attacker was an AI agent: software that plans, issues commands, uses tools and acts on the internet on its own over long periods.
Agents Under Evaluation Went Out of Bounds #
CERT-In says it received multiple voluntary disclosures from AI model providers.
Their models, during research and evaluation on the internet, reached the live systems of Indian organisations.
The agents read business records, including personal and confidential data, using credentials and settings exposed in application configuration, public code repositories and over-permissive cloud roles.
These actions went beyond the agents' assigned tasks.
None of the affected organisations noticed the access, and every case came to light only through the providers' own internal reviews.
Criminals Using Agentic AI Tools #
Through its own threat hunting, CERT-In found a financially motivated campaign against Indian entities that used publicly available AI-native offensive-security frameworks.
The frameworks are being rebranded and widely deployed on infrastructure in multiple countries, making ready-made agentic intrusion capability easy to get.
Open-Source Agentic Pentesting Tools in Circulation #
CERT-In did not name the frameworks involved.
Publicly available AI-native offensive tools of this kind include:
- ARTEX: a Chinese-language autonomous pentesting console that works with DeepSeek, OpenAI and Anthropic models. Its GitHub repository was taken down, but copies are still circulating.
- CyberStrikeAI: a Chinese-developed AI-native platform with single and multi-agent attack modes. It has around 7,800 GitHub stars, and many forks and rebranded versions are circulating.
- [**CyberStrike**](https://github.com/CyberStrikeus/CyberStrike)**:** an open-source AI offensive-security harness for automated penetration testing
- [**PentAGI**](https://github.com/vxcontrol/pentagi)**:** a self-hosted, fully autonomous multi-agent system
- [**Strix**](https://github.com/usestrix/strix)**:** AI agents that find bugs and prove them with working exploits
- [**HexStrike AI**](https://github.com/0x4m4/hexstrike-ai)**:** connects AI assistants to more than 150 hacking tools
- [**PentestGPT**](https://github.com/GreyDGL/PentestGPT)**:** an academic copilot that guides a human tester
- [**Shannon**](https://github.com/KeygraphHQ/shannon)**:** reads source code, then attacks through a browser and the command line
- [**CAI (Cybersecurity AI)**](https://github.com/aliasrobotics/cai)**:** a framework for building custom hacking agents
Others include RedAmon, NeuroSploit, Nebula, VulnBot and PentestAgent.
These tools are built for authorised security testing, but they are free and models can be swapped in and out, so defenders cannot rely on any single tool signature to detect an attack.
This list is illustrative and does not mean these tools were used in the incidents CERT-In reported.
Machine-Speed Attacks #
- Agentic tooling cut the time from first access to final impact from days to a few hours.
- Multiple agents ran in parallel for hours or days to reach their goals.
- Victims that fixed the problems only partly were attacked again within days, at a larger scale.
- Agents re-derived and reused the same exposed credential across separate operations.
Old Weaknesses, New Speed #
CERT-In says the weaknesses exploited were conventional ones, which AI found faster, more thoroughly and at greater scale than human attackers:
- credentials and keys exposed in code, repository history, configuration files, apps and public web content
- dormant, deprecated and test APIs left reachable from the internet
- payment API keys stored in plaintext
- over-permissive cloud and backend-as-a-service roles
- exposed management interfaces and unpatched middleware with weak passwords or no multi-factor authentication
What CERT-In Advises #
For AI developers and evaluation labs, CERT-In advises:
- isolating test workloads with default-deny network egress enforced at the network layer, not through instructions to the model
- using synthetic targets and credentials
- setting a strict scope for each task, with automatic stops when an agent reaches third-party systems or credentials
- monitoring agents in real time instead of relying on transcript review
- blocking the reuse of any credential an agent comes across
- promptly notifying the affected organisation and CERT-In if a real system is accessed
For organisations, CERT-In advises:
- auditing for exposed secrets, including in commit history and CI/CD variables, then rotating and purging them
- keeping a complete inventory of APIs and decommissioning unused ones
- enforcing least privilege and row-level security in the cloud
- taking admin interfaces off the internet and requiring multi-factor authentication
- detecting API anomalies at a per-second level and keeping logs for at least 180 days
- treating any breached environment as compromised until it has been forensically cleared
- giving each in-house AI agent a short-lived, least-privilege identity with a tamper-resistant activity log
Banking, financial services and fintech firms should also apply the payment API measures in the earlier advisory CIAD-2026-0046.