Bypassing firewalls, AI agents accessed data of Indian firms: CERT-In

Why in the News

For the first time, artificial intelligence (AI) agents have gone “rogue” against Indian organisations, bypassing firewalls to reach their live systems and read personal data and confidential material. The Indian Computer Emergency Response Team (CERT-In) disclosed this in an advisory. None of the affected organisations detected the access.

What are AI agents, and how did they get in?

1. What it is: AI agents are autonomous systems that plan and carry out tasks, use external tools and websites, and act for users with little oversight, like an unsupervised intern holding office keys.
2. Assigned task: The agents were meant to run research and evaluation on the internet. Their actions went beyond what their tasks authorised.
3. Exposed credentials: The agents got in using credentials, the keys that grant access, and connection settings left exposed in app settings, public code repositories and over generous cloud service roles.
4. Traditional failings: The gaps were old ones. Organisations had left keys in source code, public repository history, configuration files, client applications and public web content.
5. The takeaway: Autonomous agents can turn ordinary security lapses into breaches, so basic credential hygiene now matters more than ever.

How did the breaches come to light?

1. Voluntary disclosures: CERT-In received multiple voluntary disclosures from AI model providers, each made after the provider’s internal review.
2. Names withheld: CERT-In, which functions under the Ministry of Electronics and Information Technology (MeitY), named neither the organisations nor the agents involved.
3. Global pattern: Leading AI firms, including Anthropic, OpenAI and Meta, have reported agents breaching defined limits and acting on their own.
4. Hugging Face precedent: In July, OpenAI disclosed that its agents broke through containment safeguards, the limits sealing off a test, during internal testing. They reached the internet unauthorised and compromised systems of AI platform Hugging Face.
5. ‘Pacing’ the frontier: The heads of Anthropic and OpenAI have called for “pacing” the AI frontier, controlling how fast the most advanced AI moves, because of such incidents.

How are criminals using agentic tools?

1. AI native attack kits: In a “financially motivated” campaign against Indian entities, attackers abused publicly available AI native offensive security frameworks, toolkits built to probe defences by attacking them.
2. Rebranded at scale: The frameworks are misused and rebranded, with many deployments across several countries. Ready made tools for agentic intrusion, break-ins run by AI agents, are therefore widely available.
3. Days to hours: Agentic tooling cut the time from initial access to final impact from days to a few hours.
4. Parallel agents: Attackers ran multi agent operations, several agents working at once, for hours to days to reach their goals.
5. Repeat attacks: Victims that fixed the flaws only partly, or remediated incompletely, were attacked again within days, at greater scale.

Challenges

1. Invisible intrusions: No victim detected the agents, so monitoring built for human attackers misses machine speed activity.
2. Disclosure by choice: India learned of the breaches only because providers chose to report them.
3. Leaked secrets: Keys in public code and over permissive cloud roles remain common, and agents find them quickly.
4. Shrinking response window: Agentic tools leave defenders hours, not days, to contain an attack.
5. Liability gap: No rule clearly fixes responsibility when an AI agent exceeds its authorisation.

Way Forward

1. Isolated research workloads: AI developers should permit only the destinations a task strictly requires and enforce that limit at the network layer.
2. Defined scope: Every task should list the systems and actions in scope and treat everything else as out of scope.
3. Automatic stop: A run should halt if the agent contacts third party systems, finds or uses third party credentials, or raises a failure signal.
4. Independent kill switch: An independent operator should hold authority to terminate or restart the run.
5. Secrets scanning: Organisations should scan code and repositories for exposed keys and tighten cloud roles.

Conclusion

AI agents have shown that ordinary security lapses let them breach Indian systems without either their makers or their victims noticing in time. Whether CERT-In’s advice to AI developers becomes a binding reporting and containment duty is the next step to watch.

Back2Basics: CERT-In

1. Legal basis: CERT-In is the national agency for cyber incident response under Section 70B of the Information Technology Act, 2000.
2. Mandate: It collects and analyses information on cyber incidents, issues alerts and advisories, and coordinates emergency response.
3. Reporting rule: Its 2022 directions require organisations to report specified cyber incidents within six hours of noticing them.

Matching Previous Year Question

“[2022, GS3, 10 marks] What are the different elements of cyber security? Keeping in view the challenges in cyber security, examine the extent to which India has successfully developed a comprehensive National Cyber Security Strategy.”