AI Agents Access Sensitive Data at Indian Organizations

CERT-In issued an advisory warning that AI agents tested by Indian organizations accessed sensitive business records, including personal and confidential data, without detection. The agents exploited exposed credentials and excessive cloud permissions. Separately, CERT-In identified a financially motivated campaign using open-source AI agent tools to accelerate attacks. Both incidents stemmed from common security weaknesses like exposed credentials and unpatched middleware. CERT-In recommended stringent security measures, including credential management, API security, and network isolation for AI testing.