New Delhi: On 15 October, India’s national cyber security agency CERT-In published an advisory about intrusions that none of the victims had reported. AI agents, built by tech companies and being tested on the open internet, went beyond their tasks and accessed the live computer systems of unnamed Indian organisations.
They read business records containing personal and confidential data; none of the organisations noticed. The breaches, according to the Indian Computer Emergency Response Team (CERT-In), came to be known only after AI model providers voluntarily disclosed them following internal reviews.
What followed over the next fortnight looked much the same. CERT-In, the Defence Cyber Agency, and a private intelligence firm told the State Bank of India (SBI) on 16 October, that customer data was for sale on the dark web, the country’s largest lender told the stock exchanges five days later.
The next day, a researcher told Google, Mozilla, Apple and Microsoft that private keys (confidential secret cryptographic numbers or values used to sign digital documents) held by Bengaluru-based digital certification authority eMudhra could be exploited easily. One of the eight intermediate private keys had a value of 4.
On 20 October, details leaked of two flaws in PHP, the open source programming language behind about seven in every 10 websites worldwide, that let anyone take over a web server without a password.
And on 29 October, a hacker group claimed it had stolen customer data from AU Small Finance Bank.
“The weaknesses were old. What was missing was the ability to see them being used,” Anupam Kumar Jha, head of solutions engineering for India at Datadog, a US company that sells software for monitoring computer systems, told ThePrint. “If the first warning comes from a vendor or regulator, you don’t have visibility over your own systems.”
Old gaps, faster visitors
According to CERT-In, the AI agents got in through passwords and access keys left in code and configuration files, through forgotten application interfaces, and through cloud accounts that had been given more access than they needed.
The national cyber security agency said that criminals were using freely available AI tools against Indian organisations, and that the time from breaking in to causing damage had fallen from days to hours.
Government officials have called the advisory an early warning, and said a consultation paper on AI regulation, expected soon, may consider limits on autonomous agents.
These are problems, industry stakeholders said, that security teams have been warning about for a decade.
“AI hasn’t created new weaknesses. It has made the old ones cheap and fast to find,” Chetankumar Trivedi, global chief information officer at STL Digital, the IT services arm of the telecom equipment maker STL, told ThePrint.
He said the gaps persist because systems are built faster than anyone keeps track of them. “Permissions get granted generously to hit a go-live date, and nobody owns the job of taking them back. A leaked key gets rotated, but the old one stays in the code history.”
Most monitoring, he said, is designed to catch suspicious people, “not a valid credential quietly reading data through an API”.
Jha mentioned Datadog’s 2025 State of Cloud Security study, which found that 59 percent of users in Amazon’s cloud had an access key more than a year old, and more than half of those had not been used in 90 days. “A stale key works as well for an agent as for an attacker,” he said.
Many companies, Jha added, do not know how many AI agents are running in their systems. When an agent acts using an employee’s login, records cannot show whether a person or the agent did something.
“A misbehaving agent rarely crashes. It keeps working while dashboards stay green,” he said.
Also Read: Audits, risk checks & incident reporting—TRAI moves to regulate AI in telecom despite no new law
No time for rest
The twin PHP flaws, called PHP2Shell, showed how little time defenders have. Researchers at Calif, a security firm working under an OpenAI programme, and at Wiz, owned by Google, found them in August using AI models and reported them to PHP’s developers, most of whom are volunteers.
The plan was to announce them on 22 October, once a fix was ready.
Turns out someone was already using the PHP flaws. Amazon said its network of decoy servers recorded an attempt to exploit the flaws on 17 October, four days before the fix was released. It has not said who was behind it or how they knew. “An embargo protects defenders only until someone else finds the same bug,” the company wrote.
Details of vulnerabilities in PHP were leaked prematurely on 20 October, a day before the PHP Foundation was to release them.
Web infrastructure and security company Cloudflare saw attack traffic before the patch release (i.e., targeted code update that fixes bugs, closes security vulnerabilities, or improves performance without requiring a full reinstallation). Its chief executive Matthew Prince said attempts reached millions within a day.
As a precautionary measure, governments in the Netherlands, France, Finland and Denmark took websites offline on 21 October. That same day, CERT-In issued a critical-severity warning. No Indian organisation has reported a compromise until now, and there is no official estimate of how many Indian sites remain exposed.
The US Cybersecurity and Infrastructure Security Agency, meanwhile, confirmed attacks on 26 October. Internet survey firm Censys estimates more than 32 million PHP services are still running versions that have not been fixed.
Threat intelligence firm CYFIRMA reported scanning of unpatched systems in several countries, India among them, which it linked with moderate confidence to North Korea.
Trivedi said the usual monthly patching cycle (schedule an organisation uses to assess, test, approve, and deploy updates) no longer works for anything facing the internet.
He said companies should search their records for signs of attack from before the flaw was made public, “not just from patch day”.
Jha agreed as well. “The response window has effectively disappeared.”
The big scalp
What created a meltdown was that eight of eMudhra’s digital security certificates were found to have weak encryption keys. The keys were created in April 2025. In the company’s own words, the “issue went undetected for about 18 months, through two independent audit cycles”.
The repercussions followed: Microsoft removed seven eMudhra-linked certificates from Windows and its Edge browser on 26 and 27 October. eMudhra announced it would leave the global website certificate business, and informed the exchanges that accounting firm KPMG would review what went wrong.
Outside researchers have since reported a second incident, logged separately on Mozilla’s public tracker, over eMudhra’s servers blocking common software from downloading the lists that announce cancelled certificates, including those for the eight compromised keys.
At least seven Indian banks use eMudhra certificates under another root that Google and Microsoft are reviewing, according to a scan of bank websites by the consumer platform CashlessConsumer.
The Ministry of Electronics and Information Technology (MeitY), which has set up a team to investigate, has said that eMudhra’s domestic signature services are unaffected. Non-profit digital rights advocacy organisation Internet Freedom Foundation (IFF) has demanded the ministry to verify that claim independently.
Trivedi said most organisations can renew a website security certificate, but far fewer can say quickly where every certificate is used and which systems trust a given certificate authority. Browsers got the fix within hours, he said; servers, containers and embedded devices did not.
He said the National Payments Corporation of India (NPCI), which facilitates services such as UPI Payment, Bharat Bill Pay, FASTag, NACH, had asked participants to assess the risk of depending on a single certificate authority.
“You can outsource a service; you cannot outsource accountability for your exposure,” Trivedi said.
Who gets informed first
The cases of SBI and AU Small Finance Bank raised a different question: who is told first about such breaches.
SBI disclosed customer data exposure in a stock exchange filing on 21 October, five days after it was alerted. A seller identifying as Siriusim had posted them along with 2,722 documents the bank has not verified.
In the filing, the bank said 3,897 of about 3.75 lakh records found on the dark web held customers’ personal details, including names, mobile numbers, dates of birth and addresses.
After the IFF criticised it for telling investors before customers, the SBI said on 23 October that the affected customers were informed via email and WhatsApp. It has not said how the data was obtained.
On 29 October, a group called ScarlettGroup claimed to have stolen identity documents, PAN and Aadhaar details, credit reports and loan agreements from AU Small Finance Bank, according to the threat intelligence platform Hackmanac.
The bank said it was investigating a possible leak from a Salesforce-hosted platform holding “limited data relating to our vehicle loan customers”, and that its own systems were unaffected.
Indian rules require organisations to report cyber incidents to CERT-In within six hours. The Digital Personal Data Protection Act requires them to tell people whose data is affected. CERT-In has not said when it was told about any of these incidents.
Government reactions are now coming. On 23 October, Reserve Bank of India Governor Sanjay Malhotra said that the central bank had alerted banks to the risks from AI agents. “We have alerted them, and they are conscious about it,” he said.
Two days later, inaugurating the RBI’s data centre and cyber security training institute in Bhubaneswar, Prime Minister Narendra Modi said it had become “equally important to protect our banking system from cybercriminals and cyberterrorists”.
Subsequently, CERT-In ran an exercise on AI-enabled attacks for more than 300 officials from over 55 financial institutions, most of them regional rural banks and cooperative banks. These are lenders that often have fewer security staff and older systems.
Both Jha and Trivedi said rules on AI agents should focus on what an agent can reach and do, rather than on the AI model.
Trivedi said each agent should be treated “as a highly privileged employee who works at machine speed and never sleeps”. It should have its own login, a named owner and a way to be shut down, and payments, deletions and data exports should need human approval.
Disclosure should be mandatory, he said. “The recent cases surfaced only through voluntary disclosures by AI model providers, and that can’t be the long-term model.” Rules should also be proportionate, he added. “Rules that smaller firms can’t realistically follow won’t make anyone safer.”
Similarly, Jha said any new requirements should fit with CERT-In’s six-hour reporting rule, the data protection law and RBI rules “rather than adding a parallel compliance stack”. He said company boards should be asking whether they would detect an agent going beyond its task, “or hear about it from a vendor first”.
(Edited by Tony Rai)