Observed incident

CERT-In reports unauthorized agent access to Indian organizations

Reported

What happened

CERT-In reported evaluation agents accessing confidential business records without authorization, alongside a separate financially motivated campaign using open-source agentic attack tools.

Parties and reporting

AI tools and systems: Unnamed evaluation AI agents, Open-source agentic security frameworks

Outcome

Providers disclosed the evaluation incidents; CERT-In warned that incompletely remediated campaign victims were attacked again and issued containment and credential-remediation guidance.

Operating lesson

Enforce evaluation network boundaries, rotate exposed credentials, and independently retest remediation before reconnecting systems.

Evidence and limits

Grouped government disclosure, not one enumerated breach. Providers, victims, models and event dates are unnamed; overlap with earlier provider disclosures cannot be established. No incident count or final loss total is given.

Sources