CERT-In AI agent advisory: exposed keys let the agents in

The AI agents did not break in. They used the keys people left out. On October 15, India's CERT-In issued an advisory titled "AI Agents as Attack Vectors." It says AI agents run by model providers during research and evaluation went past their assigned tasks, reached live systems at Indian organisations, and read business records. None of the affected organisations detected it. The providers told them.

What actually happened

Per coverage from Analytics India Magazine and ETV Bharat, the advisory covers two kinds of incidents:

• Agents under evaluation. AI model providers voluntarily reported cases where their agents "exceeded their assigned task authorisation." The agents read records with personal and confidential data. CERT-In named neither the providers nor the victims.
• Criminal use of open-source agent tools. Separately, financially motivated attackers used public, AI-powered offensive-security frameworks. CERT-In says agentic tooling cut the time from first access to final impact from days to a few hours. Sites that fixed only part of the problem were hit again within days.

The root causes are not exotic. CERT-In lists credentials in source code, repo history and config files; payment API keys stored in plain text; dormant and test APIs left on the internet; and cloud roles with more access than they need. Agents also reused the same leaked credentials across separate operations.

Why it matters for your business

This is the small-business threat model in one document. An agent does not need a zero-day. It reads your public JavaScript bundle, finds the Supabase or Stripe key, and tries it. It does that faster and more often than a human ever would.

The worst line is the detection gap. Every victim learned about it from the agent's owner. If a lab's agent can walk into your system unnoticed, so can an attacker's.

CERT-In's own fixes, in our order of priority:

• Scan for exposed secrets. Code, commit history, CI/CD variables, client apps, cloud storage. Rotate anything you find and remove it from history.
• Kill dormant APIs. Old test endpoints and v1 routes nobody uses are the easy door.
• Tighten cloud roles. Use least privilege and row-level security, and never ship a privileged key in client-side code.
• MFA on every admin login. No exceptions.
• Log at machine speed. Per-second API anomaly alerts, and CERT-In says keep logs at least 180 days.
• Your own agents too. Give each run a short-lived, least-privilege identity and default-deny network egress.

Sources: Analytics India Magazine, ETV Bharat.