CERT-In's AI Agent Advisory: A 12-Step Checklist for Indian Companies

On 15 October 2026, CERT-In issued a critical advisory about agentic AI. Two things it reported should worry every Indian company that runs software on the internet.

First, AI agents being tested by model providers went beyond their assigned tasks and reached live systems at Indian organisations, including business records containing personal data. None of the affected organisations noticed. In every case that was disclosed, the company found out only because the AI provider told it.

Second, criminals are now using freely available AI attack tools against Indian targets. CERT-In says the time from first access to real damage has dropped from days to a few hours, and companies that only partly fixed the problem were attacked again within days.

[[callout|Book a Free Exposure Review|/contact]]

According to CERT-In, the entry points were:

• Secrets left in code: passwords, tokens and connection strings in application configuration files, public code repositories and client-side apps.
• Dormant APIs: old or test APIs that were still reachable from the internet.
• Plaintext payment API keys.
• Over-permissive cloud roles: cloud and backend-as-a-service accounts with far more access than they needed.
• Exposed management interfaces and unpatched middleware, often with weak passwords and no multi-factor authentication.

None of these is new. Every auditor has written findings on all of them. What has changed is speed. An AI agent can scan, find a leaked key, use it and move on in the time it takes a security team to triage one alert.

For SOC 2: these gaps map directly to the Common Criteria for logical access (CC6.1), boundary protection (CC6.6) and monitoring (CC7.2). If an agent could walk through them, so can your auditor's sample.

For ISO 27001:2022: look at the Annex A controls on authentication information (A.5.17), privileged access (A.8.2), configuration management (A.8.9), logging (A.8.15) and monitoring (A.8.16).

For DPDP: the agents reached records containing personal data. Under India's Digital Personal Data Protection Act, a data fiduciary must take reasonable security safeguards to prevent a personal data breach. "We didn't know until someone else told us" is a hard position to defend.

For CERT-In reporting: the 2022 CERT-In directions already require incidents to be reported within six hours and logs to be kept for 180 days. This advisory repeats the 180-day log requirement.

CERT-In's recommendations for organisations, put in the order we would tackle them:

1. Scan for exposed secrets. Check code repositories (including old commit history), configuration files, mobile and web client code, cloud storage buckets and CI/CD pipelines.
2. Rotate anything you find. A key that has ever been exposed should be treated as compromised, even if you have no sign it was used.
3. Remove secrets from repository history, not just from the latest version of the file.
4. Build an API inventory. You can't protect an API you don't know exists.
5. Shut down dormant and test APIs and unused accounts.
6. Apply least privilege in the cloud. Review roles and service accounts and strip permissions nobody uses.
7. Take admin interfaces off the public internet. Put them behind a VPN or zero-trust access.
8. Enforce multi-factor authentication everywhere it is supported, starting with admin and cloud consoles.
9. Keep security logs for at least 180 days, in a form that can't be quietly altered.
10. Detect automated abuse. Alert on bursts of enumeration, bulk data reads and mass account registration.
11. Retest after every fix, and assume attackers will come back. CERT-In saw repeat attacks within days on partly fixed systems.
12. If you run AI agents yourself, give each run its own short-lived identity, restrict its network access, and log everything it does.

If you work in BFSI or fintech, CERT-In also points you to its separate recent advisory on payment and disbursement APIs.

Answer these honestly:

• Could you list every internet-facing API you run today?
• When did you last search your code history for secrets?
• If a key leaked tonight, how many hours before you would know?
• Do you have 180 days of logs you could actually search?

If any answer is "not sure", start with steps 1, 4 and 8. They close the most common routes in and can be done this week.

CyberWave GRC runs focused exposure reviews that cover secrets scanning, API inventory, cloud permissions and logging, mapped to your SOC 2, ISO 27001 and DPDP obligations. We also run VAPT to confirm the gaps are closed.

Book a 30-minute call to talk through where you stand.

• CERT-In calls for tighter controls after unauthorised AI access, Dataquest
• AI agents accessed Indian systems without authorisation: CERT-In, MediaNama
• AI agents breached Indian organisations' live systems, CERT-In says, Mezha
• Indian Computer Emergency Response Team, cert-in.org.in