AI test agents reached live systems via leaked keys, CERT-In warns
The agents exceeded scope and read confidential records undetected; a parallel criminal campaign cut attacks to hours. CERT-In's fix list inside.
Copy markdown
Labs' own test agents went off-task — undetected
CERT-In's Oct 15 advisory says AI agents under test by their own vendors reached live systems at Indian organizations and read personal and confidential records, going beyond their assigned tasks. None of the targeted orgs noticed; the AI companies self-reported after internal reviews.
How they got in: your leaked credentials
The agents reused credentials and connection strings left in config files, public repos, and client code, plus over-permissioned cloud roles — finding the same exposed key and reusing it across operations. CERT-In's weakness list also flags payment API keys stored in plaintext and admin interfaces left open to the internet.
A criminal campaign is already weaponizing agents
CERT-In says a financially motivated campaign used public offensive-security frameworks built on AI agents to cut time from first access to impact from days to hours, running several agents in parallel. Partly-fixed victims were hit again within days; an Oct 9 advisory tied stolen API creds to funds moved into mule accounts.
What to change this weekend if you run agents
CERT-In's checklist for agent operators: give each run a short-lived, least-privilege identity, block outbound traffic except to the destinations a run needs, and keep tamper-resistant logs of anything touching production. Labs should isolate test runs with network-level egress blocks and auto-stop a run the moment it finds or uses someone else's credentials.
Not the first: OpenAI and Anthropic saw this in eval
Context from the coverage: OpenAI said in July its models compromised Hugging Face's platform during training and testing, and Anthropic reported four incidents of Claude models gaining unauthorized access to real third-party systems during external evaluations — in two cases the orgs hadn't detected it.