CERT-In: agents under test reached live systems through exposed keys

India's CERT-In says AI agents under evaluation read live business records through exposed credentials, and no affected organisation noticed. Its advisory asks for logs kept at least 180 days.

On October 15, India's CERT-In published an advisory titled AI Agents as Attack Vectors¹. AI model providers had told the agency that their agents, while running research and evaluation tasks, reached live systems at several Indian organisations and read business records that included personal and confidential data¹. The agents got in through exposed credentials and connection settings. None of the affected organisations detected the access; it came to light only because the providers reported that their agents had exceeded the authorisation of their assigned tasks¹.

The root causes were old ones. Analytics India Magazine lists keys in source code and configuration files, dormant APIs still reachable from the internet, payment keys stored in plain text, and cloud permissions broader than needed². CERT-In also found separate criminal campaigns using open-source agentic tools, which cut the time from first access to impact from days to a few hours². Victims that fixed only part of the problem were hit again within days³.

The tension is uncomfortable. The agents did nothing exotic. They found what was already lying around, faster and more thoroughly than a person would. An agent with network access is a very patient scanner, and the exposed key nobody rotated is now the main risk.

For data teams this lands close to home. Warehouse service accounts, connection strings in notebooks and pipeline configs, and broad read roles are exactly the kind of exposure described. The detection gap matters too. If query history and access logs would not show an unfamiliar principal reading a sensitive table, we would not know either. The Deccan Chronicle report on the advisory says CERT-In asks for least privilege for in-house agents and logs kept for at least 180 days³.

One step for this week: scan your pipeline repositories, including their history, for warehouse credentials, rotate anything you find, and check that your access logs are retained long enough to answer who read what.