Signing you in

Listen 00:00 0.5x 0.75x 1x 1.25x 1.5x 2x AI Narration This audio is AI generated.

Days after India’s nodal cybersecurity agency warned that ‘rogue’ or misaligned AI agents targeted Indian organisations and gained unauthorised access to their live systems, experts called into question enterprises’ ability to defend against such attacks where security vulnerabilities are exploited at “machine speed”.

In an advisory dated Thursday, October 15, The Indian Computer Emergency Response Team (CERT-In) said that under-testing AI agents flouted their initial task authorisations, issued commands, invoked tools, reached the internet, and eventually gained unauthorised access to the live systems of unnamed Indian organisations.

The rogue agents were able to access business records, personal data, and other confidential information. They carried out these attacks using exposed credentials, publicly accessible code repositories, and overly permissive cloud access settings, as per the advisory.

CERT-In also detailed another category of cyber attacks against Indian entities, where human threat actors used open-source agentic AI tools to hack into servers as part of a multi-stage, financially motivated campaign.

“The most damning line in the advisory is that none of the affected organisations caught the access themselves,” Yash Kadakia, founder and CTO, Sky Brigade, an AI security consultancy firm, said. While the rogue AI agent incidents came to light through voluntary disclosures by AI model providers, CERT-In said it uncovered the financial campaign attacks through forensic analysis of suspicious activities.

With this, India joins a growing list of countries and organisations targeted by AI agents behaving in unintended, problematic ways. During internal testing, AI agents from OpenAI, Anthropic, Meta, and Google have escaped containment, reached the open internet, and hacked or attempted to breach various organisations’ websites and internal systems.

The sheer number of incidents reported in recent months suggest that the problem may be far more complex than what is publicly known. Among government entities, a statistics portal run by the Australian government as well as multiple websites of US government agencies have been targeted by rogue agents specifically linked to OpenAI.

In India’s case, however, several questions remain unanswered, such as which companies’ AI agents were involved, which organisations and sectors were targeted, which specific datasets were accessed, and how many users could be affected. It is also unclear whether the rogue or malicious activities led to successful breaches, how long did the attacks go on for, what steps were taken post-incident, and whether affected users or customers have been notified.

“Vulnerabilities that may have been manageable when accessed by humans can become significantly more consequential when AI agents are able to discover and exploit them autonomously,” Roshmik Saha, chief technology officer (CTO) at data security firm Skyflow, said.

“The challenge is compounded by the speed at which AI can accelerate attack workflows, reducing the time available to detect and contain threats,” Sunil Sharma, managing director and VP-sales (India & SAARC), Sophos, said. “None of these attacks used sophisticated AI capability to find zero-day vulnerabilities or anything unprecedented. This shows that the cybersecurity conditions of the firms under attack are terrible, and need overhaul and require proper regulatory intervention,” IIIT-Hyderabad’s Shukla suggested.

Beyond rogue AI agents, CERT-In also warned about human threat actors abusing “publicly available, AI-native offensive-security frameworks” to carry out a financially motivated campaign targeting Indian organisations. This set of attacks primarily relied on open-source agentic AI tools, as per the cybersecurity watchdog.

The security risks posed by open-weight AI models have fuelled a debate over whether they should be banned, particularly those developed by Chinese AI companies like DeepSeek and Tencent. CERT-In’s findings suggest that this debate could now reach India. But when asked if open-source or open-weight AI tools are riskier than closed systems, many experts said no.

“The answer is to shift from detecting known bad files to detecting suspicious behaviour: who ran a tool, from where, at what time, and what happened next. In regulated and operational environments, that context matters more than the tool itself,” Chhabra added.

“The risk usually depends on how these tools are deployed and extended. For example, nearly a thousand publicly accessible installations of the open-source OpenClaw AI agent were found running without authentication, and over 230 malicious plugins were published for it within a week,” Kaspersky’s Singh said.

Notably, CERT-In’s advisory stated that after the targeted companies partially addressed the security flaws, the agents in the financially motivated campaign struck again within days, at a greater scale. In the voluntarily disclosed incidents, the rogue agents re-derived and re-used the same exposed credential in separate operations.

It highlights widening gaps in persistent detection and response within organisations, particularly around identity security, monitoring, and incident readiness, experts said.

“Sophos’ Active Adversary Report 2026 found that multi-factor authentication was absent in 59 per cent of the incident response cases analysed, while log-retention gaps doubled year on year. Sophos’ State of Ransomware in India 2026 also found that 79 per cent of Indian ransomware victims said the incident coincided with their most significant identity attack,” Sharma said.

“For law enforcement, investigating these cases needs forensic skills and cross-system log correlation that are still scarce. For enterprises, the decisive factor is recovery. Even a well-detected attack becomes a business crisis if backups are not clean, isolated, and tested,” Acronis’ Chhabra said. Others pointed out that collaboration between the public and private sectors will be just as important.

“Traditional approaches that grant broad permissions and rely on static credentials are not sufficient when an agent can independently navigate systems and retrieve information. Access needs to be limited to exactly what the agent requires, for exactly as long as it requires it,” Skyflow’s Saha said.

Another proposed recommendation for enterprises to strengthen their defence was “to point an AI agent at yourself before someone else does.”