India’s CERT-In issues a Critical advisory on AI agents reaching Indian systems

CERT-In (Indian Computer Emergency Response Team) says AI model providers voluntarily disclosed that their models, during research and evaluation on the internet, read Indian organisations’ business records, including personal data, through exposed credentials and overly broad cloud permissions. In a separate, financially motivated campaign, attackers’ agent tools cut the time from first access to impact from days to a few hours. No affected organisation detected the access itself, and CERT-In hasn’t named the providers or the organisations.