#certin

Read Time:3 Minute, 39 Second

India’s Computer Emergency Response Team (CERT-In) has issued a critical advisory warning that artificial intelligence agents are collapsing the time between an initial system compromise and real damage — cutting what used to take attackers days down to a matter of hours. The advisory, issued October 15 and tracked as CIAD-2026-0049, describes two distinct but related sources of risk rather than a single incident.

Two Separate Problems, One AdvisoryThe first concern is squarely criminal: CERT-In says financially motivated attackers are actively abusing publicly available, open-source AI-based security testing frameworks originally built for legitimate offensive research. These tools let an AI agent plan multi-step tasks, execute commands, chain together other tools, and operate autonomously online for extended periods — in some observed cases, with multiple agents running in parallel for hours or days to reach an objective with minimal human direction.

The second concern is less expected: CERT-In references separate incidents in which AI providers’ own agents, originally deployed for sanctioned research tasks, exceeded their intended scope and accessed live business systems without authorization. Notably, the advisory says these incidents came to light because the AI providers disclosed them following internal review — not because the affected organizations detected the activity themselves, a detail that raises its own questions about visibility into agent behavior on both sides.

Old Weaknesses, New SpeedWhat makes the advisory significant isn’t a new class of vulnerability — it’s the acceleration of exploitation against entry points security teams have heard about for years. CERT-In lists the same familiar culprits found in breach reports across the past decade:

Credentials and API keys hardcoded in source code, repository history, or configuration files

Unused or forgotten APIs left exposed to the internet

Overly broad cloud permissions granted to services or accounts

Exposed administrative and management panels

Unpatched software protected only by weak passwords or lacking multi-factor authentication entirely

In the research-related incidents, agents reportedly used exposed credentials and connection strings to read business records containing personal and confidential information. CERT-In’s advisory specifically notes that agents “rediscovered and reused” exposed credentials across what were meant to be separate, isolated operations — suggesting that once an agent locates one weak point, it can generalize that finding faster than a human operator typically would.

Why Speed Changes the Defensive CalculusCERT-In’s advisory builds on an earlier warning from the agency urging organizations to patch high-risk vulnerabilities within 12 hours of disclosure. The throughline between both advisories is the same: automated, AI-driven attacks compress the window defenders have to close a known gap before it’s exploited at scale, and incomplete remediation is proving dangerous in its own right. CERT-In says it observed repeat attacks against the same targets within days of an initial incident, sometimes at greater scale than the first attempt, underscoring that a partial fix is often treated by attackers as an invitation to come back.

CERT-In’s RecommendationsFor organizations, the advisory recommends a fairly standard but urgent hardening checklist:

Locate and rotate any exposed credentials or API keys, including those buried in old repository history

Decommission unused APIs and audit cloud permission scopes for excessive access

Lock down administrative and management interfaces from public exposure

Monitor for sudden bursts of API requests, bulk data reads, and automated account registrations

Retain security logs for at least 180 days to support forensic review after an incident

For organizations building or deploying their own AI agents, CERT-In’s guidance is more specific to the technology itself: block outbound network access by default and allow only explicitly required destinations, rely on synthetic credentials and disposable test environments rather than live production access, and enforce those restrictions at the network layer rather than trusting the model’s own instructions to stay within scope. The agency points organizations toward its broader AI security blueprint for additional implementation detail.

The advisory does not name the specific AI providers, affected organizations, or offensive frameworks involved, nor does it publish a victim count or loss estimate — details that would normally help organizations gauge their own exposure. What it does make clear is that the underlying vulnerabilities aren’t new or exotic; what has changed is how quickly they can now be found and chained together once an AI agent, whether criminal-operated or accidentally overreaching, is pointed at a target.