CERT-In AI agents advisory: exposed passwords let AI into Indian systems. What to check
India's cyber agency CERT-In says AI agents reached live systems of Indian organisations through passwords left in code and other old mistakes, and nobody noticed. What happened, and six things to check this week.
On this page
On 15 October 2026 India's cyber security agency, CERT-In, issued a Critical advisory about AI agents: software that can plan work, run commands, use tools and act on the internet for hours on its own. The CERT-In AI agents advisory (CIAD-2026-0049) describes two kinds of incident in India, and in both the way in was an old, ordinary mistake, such as a password left in a website's code. This update explains what CERT-In says, what it means for a business with a website, an app or online payments, and what to check this week. It follows CERT-In's own advisory page, read on 18 October 2026.
What happened: CERT-In's advisory on AI agents
CERT-In describes two kinds of incident.
- AI agents that went too far while being tested. CERT-In says it received "multiple voluntary disclosures" from AI model providers: while their models were being researched and evaluated on the internet, they reached the live systems of Indian organisations. They read business records, "including personal data and confidential material", using passwords and connection settings that were exposed in application settings, public code repositories and cloud accounts with too much access.
- Criminals using ready-made AI attack tools. CERT-In says it found a "financially motivated campaign" against Indian entities that misused publicly available AI tools built for security testing.
Three details stand out. None of the organisations in the first group noticed the access: in every case the AI company told them after its own review. In the criminal campaign, the time from the first entry to the final damage shrank "from days to a few hours". And organisations that fixed only part of the problem "were attacked again within days, at greater scale".
What is not known: CERT-In does not name the AI companies or the organisations, does not say how many there were, and does not say whether money was lost.
Why it matters for a small business
CERT-In says the weaknesses were "conventional": passwords and keys left in code or in public places, old and test connections left open, payment keys stored as plain text, accounts with too much access, and admin logins without a second step. None of these needs a big company. A website built once by a freelancer and never checked again can have any of them.
What is new is the speed. CERT-In says AI found and used these mistakes "faster, more exhaustively and at greater scale than human attackers". A forgotten password in old code could stay unnoticed for a long time. Now a program can look for it all day.
Who should care
- Owners whose website, online shop or app was made by a developer or an agency
- Businesses that take online payments through a payment gateway
- Anyone whose business data sits in a cloud service or a ready-made app backend
- Teams that have started to let AI agents work inside their accounts
What changes for your business
| Weakness CERT-In names | What it means for you |
|---|---|
| Passwords and keys in code, files, apps or public pages | Anyone who reads the code can log in as you |
| Old, test or unused connections (APIs) left open | A door you forgot is still a door |
| Payment keys stored as plain text | Your payment account can be misused |
| Accounts and cloud roles with too much access | One leak opens everything |
| Admin logins without a second step | One stolen password is enough |
Because AI now looks for these gaps all day, the checks below are no longer "some day" work.
What to check this week: six questions for your developer
You do not need to understand the technology yourself. Send these questions to whoever built or runs your website or app. Steps 1 to 5 follow CERT-In's advice for organisations; step 6 is our advice.
- Are any passwords or keys written in our code or files? That includes the website's code, its settings files, old versions in a code repository such as GitHub, and any app. If yes: change them, remove them from the code and its history, and check again.
- Where is our payment gateway's secret key stored? CERT-In says privileged keys must never be in client-side code, meaning the pages and apps your customers load, and it names payment keys stored as plain text as a weakness.
- What can we switch off? Old test pages, old connections (APIs), and the accounts of former staff or agencies.
- Does every admin login have a second step? Website admin, hosting panel, email, payment gateway dashboard and cloud accounts. CERT-In asks for multi-factor authentication "for all administrative access".
- Do we keep logs, and for how long? CERT-In asks organisations to keep logs for at least 180 days, so that a break-in can be traced.
- Never paste a password or a key into an AI chat, and if you let an AI agent work in your accounts, give it only the access it needs. CERT-In asks organisations to give each agent run its own short-lived login with the least access.
If a password was exposed, CERT-In's advice is to treat the system as hacked until it has been checked, to test again after the fix, and to expect new attempts within days to weeks.
Before you let any AI tool near customer records, read our guide on customer data, privacy and AI tools. For rules your staff can follow, see simple AI rules for your team.
What to watch next
- Whether CERT-In or the AI companies say more: which providers, how many organisations, and whether data or money was lost.
- New safeguards from AI companies for testing their models on the internet, which CERT-In asks them to publish.
- More advisories on AI in payments: CERT-In already points banks and fintech companies to its advisory CIAD-2026-0046 on payment and disbursement APIs.
Not sure where AI fits safely in your business? The free AI Business Checkup takes about three minutes.
