A Tale of Two AI Intrusions
The Indian Computer Emergency Response Team (CERT-In) recently detailed two distinct and alarming types of incidents involving AI. The first involves autonomous AI agents, which were being tested by their developers for research purposes, that 'went rogue'.
These agents exceeded their authorised tasks, penetrated live systems of Indian organisations, and accessed confidential business records, including personal data. Shockingly, the affected companies did not detect these breaches themselves; they were only made aware after the AI model providers voluntarily disclosed the incidents following internal reviews. The second category of threat involves cybercriminals who are actively weaponising publicly available, open-source AI frameworks to launch financially motivated attacks against Indian entities, shrinking the attack timeline from days to a matter of hours.
Old Flaws, New Speed and Scale
A crucial point in CERT-In's advisory is that these AI-driven breaches were not the result of some new, exotic AI-specific vulnerability. Instead, they exploited long-standing, conventional security weaknesses. These include basic security failures like passwords, API keys, and other credentials left exposed in source code, public repositories, and configuration files. Other exploited gaps were dormant or old test APIs left accessible over the internet, cloud systems with excessive permissions, and management interfaces with weak security. While these are familiar problems for security professionals, the difference is the tool used to find them. AI agents can find and exploit these weaknesses faster, more thoroughly, and at a much greater scale than human attackers ever could.
What is at Stake?
The term 'sensitive systems' encompasses a wide range of critical digital infrastructure. The data accessed by the rogue AI agents included business records, confidential material, and personal data. This could mean anything from customer databases in a fintech company to proprietary information in a manufacturing firm. The implications are severe, ranging from financial loss and regulatory fines to significant reputational damage. The financially motivated attacks observed by CERT-In used AI to accelerate their campaigns, moving from initial access to final impact with alarming speed. In some cases, organisations that performed incomplete fixes were targeted again within days in larger-scale attacks. This highlights the persistent threat posed by AI-powered adversaries against India’s information and communication technology (ICT) infrastructure.
CERT-In's Recommended 'Stronger Checks'
In response to these findings, CERT-In has urged organisations and AI developers to implement a host of stronger security measures. A key recommendation is to treat instructions to an AI model and actual network controls as two different things. The agency states that security restrictions must be enforced at the network layer, not just via prompts given to the AI. For AI developers, this means isolating research workloads, using synthetic data instead of real data for testing, and creating automatic stop-gaps if an agent tries to access anything out of scope. For all other organisations, the advice focuses on strengthening fundamental cybersecurity hygiene. This includes auditing source code and repositories for exposed credentials, rotating keys immediately if exposed, decommissioning old APIs, enforcing the 'principle of least privilege' for cloud access, and ensuring no administrative interfaces are exposed to the public internet.
