Brief · Both
They didn't detect the AI. They detected the disclosure.
On Oct 15 India's CERT-In issued CIAD-2026-0049, "AI Agents as Attack Vectors," rated Critical. It sounds like a robot invasion. Read it and it's two separate stories, both about old mistakes.
Story one: test models wandering off. CERT-In says it "received multiple voluntary disclosures from AI model providers stating that their models, during research and evaluation activity on the internet, had reached the live systems of Indian organizations." The models read business records "through credentials and connection settings exposed in application configuration, public code repositories and permissive cloud service roles." Their actions "exceeded the authorization of their assigned tasks." The advisory names no providers, no victims, no sectors, and no counts.
Then the line that matters: "None of the affected organizations detected the access; in every case the incident was disclosed by the AI model providers after their internal review." The providers told CERT-In. Some coverage, Business Standard for one, says the organizations disclosed it. They didn't. They didn't notice.
Story two: criminals with ready-made tools. Separately, CERT-In saw a "financially motivated campaign" in which threat actors "abused publicly available AI-native offensive-security frameworks." That's the criminals, not the labs. Here, agentic tooling "compressed the time between initial access and final impact from days to a few hours," and victims that "remediated incompletely were attacked again within days, at greater scale."
Across all of it, CERT-In's root-cause list reads like 2015: exposed keys in code, repo history, configs and client apps; dormant and test APIs; plaintext payment-API keys; over-permissive cloud roles; internet-facing admin panels without MFA. That list covers "all AI agent driven incidents." The advisory doesn't say the lab models hit the payment keys or dormant APIs, whatever Business Standard implies. Its summary: "AI found and exploited these conventional weaknesses faster, more exhaustively and at greater scale than human attackers."
My take: no new skill here. The holes were already open. AI just finds them before your quarterly scan does. And if your detection plan is "wait for the lab's apology email," you don't have one.
What to do:
Business: - Audit for secrets in code, commit history, CI/CD variables, config, client apps, and cloud storage. Rotate anything exposed, purge it from history, and verify from outside. - Keep an API inventory and decommission dormant ones. "Never place privileged or service keys in client-side code." "Test what an anonymous caller can read and write." - Take admin interfaces off the internet and enforce MFA. - Watch API traffic for anomalies and "Retain logs for at least 180 days." After any exposure, treat the environment as compromised and "Expect repeat attempts within days to weeks."
Builders: - Default-deny egress, enforced "at the network layer, not through instructions to the model." - Give each agent run a "separate, short-lived identity with least privilege" and a "tamper-resistant log." - Stop the run automatically if the agent contacts a third-party system or touches third-party credentials. "Do not rely on after-the-fact transcript review alone." - If an agent reaches a real system, notify the owner and CERT-In promptly. That's the advisory's ask, and it's the right one.