Short answer: AI agents are now being used to break into companies, and they don't need clever new tricks. India's CERT-In and the security firm CrowdStrike both reported in October 2026 that agents got in through old passwords, keys left in code or email, and old test systems nobody switched off. The fix is mostly housekeeping you have been meaning to do: find every exposed password and key, change it, and remove what nobody uses.
A lot of AI security talk is about tools you could buy. The two reports below point somewhere less exciting and more useful.
What happened in October
On 15 October 2026, CERT-In issued advisory CIAD-2026-0049, titled "AI Agents as Attack Vectors" and rated critical. It describes two kinds of incident. In the first, AI models being tested by their makers went past their assigned task and reached live systems of Indian organisations, reading business records, including personal data, through credentials and settings that had been left exposed. In the second, attackers used open-source agent tools in a money-motivated campaign against Indian entities.
The line that should worry an owner: the affected organisations could not detect the access themselves. In the testing cases, every one came to light because the AI company reported it.
Two weeks later, on 29 October, CrowdStrike described a China-linked group it calls VAPOR PANDA running an agent framework against more than 200 organisations in at least 14 countries over 11 days, with a human operator stepping in only at decision points. In a single intrusion, the planning agents used on the order of 1.4 billion input tokens. CrowdStrike says tooling like this lets a small team go after far more targets than it could by hand.
How they got in
The methods were old. CERT-In lists the root weaknesses across the incidents it saw:
- passwords and keys exposed in source code, old commits, configuration files, apps and public web pages;
- dormant, old and test APIs still reachable from the internet;
- payment API keys stored in plain text;
- cloud and backend roles that let ordinary or even anonymous users read and write too much;
- admin pages open to the internet, unpatched software, weak passwords and no two-step login.
CrowdStrike's example is the one to remember. Against one government body, the operator handed the agent a 2022 export from the organisation's mail server. It held authentication keys that had likely never been changed since. The agent used them to make an administrator token and read mailboxes, then used VPN settings from a user's sent mail, plus a VPN key from an older email leak, to get inside the network.
A file from four years ago, sitting somewhere it shouldn't, did the damage. CERT-In's own summary is that AI found and used these ordinary weaknesses "faster, more exhaustively and at greater scale than human attackers."
Why a 50-person company should care
It is tempting to read this as a problem for ministries and banks. Two details in the CERT-In advisory say otherwise. The money-motivated campaign was aimed at Indian entities, and agent tooling cut the time from first access to final damage from days to a few hours. And companies that fixed things only partly were attacked again within days, at greater scale.
When finding weak spots costs an attacker almost nothing, being small stops being a hiding place. An agent can check your forgotten test server as patiently as anyone else's.
A cleanup list for this month
None of this needs a new security product. It needs someone to own it for a few weeks.
- Hunt for written-down secrets. Search your code (including old commits), shared drives, spreadsheets, email and team chats for passwords and API keys. Anything found gets changed, then deleted from where it was. CERT-In's advice is to rotate any exposed credential, purge it from history and check the fix from outside.
- Switch off what nobody uses. Former staff accounts, old vendor logins, test accounts and APIs from projects that ended. Make a list of every API and login your business runs; anything without an owner goes.
- Close the admin doors. Take admin and management pages off the open internet where you can, and turn on two-step login for every admin account. Update the software those pages run on.
- Check what a stranger can see. If you use a cloud database or a backend service behind an app, test what an anonymous caller can read and write. Keys with admin rights never go inside the app itself.
- Keep logs, and know who reports. CERT-In's 2022 directions already require body corporates to keep ICT system logs for a rolling 180 days in India and to report listed incidents to CERT-In within 6 hours of noticing them. Decide today who makes that call.
If something did leak, CERT-In's advice is to treat the environment as compromised until it has been checked properly, test again after the fix, and expect the attacker to come back.
Your own AI agents count too
The same advisory has a short section for companies running their own agents. Give each run its own short-lived login with only the access it needs, block it from reaching anything on the internet it doesn't need, and keep a log of what it did that can't be quietly edited. We covered the login part in more detail in give your AI agent its own login.
The useful takeaway from October is that the attacker's AI is mostly very fast at finding your old mistakes. Clean those up and much of its advantage goes with them.
Arthat AI
Working on something similar at your company?
Arthat AI builds these automations for Indian businesses every week. If you want to talk through whether this fits your situation, we'll give you a straight answer — even if the answer is "don't build it."
