In an advisory issued Oct. 15, the Indian Computer Emergency Response Team (CERT-In) said AI model developers had voluntarily disclosed multiple incidents in which autonomous agents exceeded their assigned tasks and accessed live systems belonging to Indian organizations.
None of the affected organizations independently detected the unauthorized access, highlighting the challenges of identifying security incidents involving autonomous AI systems, the agency said.
Alongside these incidents, CERT-In identified financially motivated cyberattacks involving publicly available AI-powered offensive security tools, warning that organizations could remain vulnerable when security weaknesses were not fully addressed.
Some organizations were attacked again within days of their initial incidents after failing to resolve their vulnerabilities, the agency added.
In response, CERT-In urged AI developers to restrict autonomous agents' internet access and conduct testing in simulated environments rather than on live systems.
The agency also called on developers to report unauthorized activity involving their AI tools immediately, while advising organizations to strengthen authentication measures, remove exposed credentials and improve monitoring for automated cyberattacks.
To support the detection and investigation of security incidents, CERT-In further recommended that organizations retain security logs for at least 180 days.