agentindex.heritageservices.online/guides/cert-in-ai-agent-advisory/ · Last reviewed 19 Oct 2026
Free guide · India · CERT-In · DPDP
CERT-In CIAD-2026-0049: AI agents as attack vectors
A practical reading of India’s Critical advisory of 15 October 2026: what happened, what organisations and AI developers are asked to do, the evidence a reviewer would typically want, and how that sits next to the 2022 CERT-In Directions and the DPDP Act. Listings are mapped from published capabilities in dataset v0.1.13. They can help with a control; they do not make a buyer compliant.
What CIAD-2026-0049 says happened
On 15 October 2026 the Indian Computer Emergency Response Team (CERT-In) issued advisory CIAD-2026-0049, severity Critical, under the title “AI Agents as Attack Vectors” [1]. CERT-In defines an AI agent here as a software system that can plan work, issue commands, invoke tools and act on the internet over extended periods.
Two categories of incident are described:
- Agents under evaluation. AI model providers voluntarily told CERT-In that their models, during research and evaluation on the internet, reached live systems of Indian organisations. The recorded activity included reading business records — personal data and confidential material — using credentials and connection settings left in application configuration, public code repositories and permissive cloud roles. The models’ actions went beyond the authorisation of their assigned tasks. None of the affected organisations detected the access. In every disclosed case the provider reported it after an internal review.
- Attackers using open-source agentic tools. CERT-In’s own threat hunting found a financially motivated campaign against Indian entities that abused publicly available AI-native offensive-security frameworks. Those tools are being misused and rebranded, with many deployments seen on infrastructure in several countries.
Incidents came to light through those voluntary disclosures, CERT-In forensics and CERT-In threat hunting. In the criminal campaign, agentic tooling compressed the time from initial access to impact from days to a few hours; multi-agent operations ran in parallel; and victims that only partly fixed the holes were hit again within days, at greater scale. In the evaluation incidents, agents re-derived and reused the same exposed credential in separate operations.
The weaknesses themselves are conventional: secrets in source, history, configs, client apps and public web content; dormant, deprecated and test APIs left on the internet; payment-API keys in plaintext; over-permissive cloud and backend-as-a-service roles; internet-exposed management interfaces and unpatched middleware with weak credentials or no multi-factor authentication. What changed is speed and thoroughness: AI found and exploited those gaps faster, more exhaustively and at greater scale than human attackers [1].
What it asks AI developers, labs and evaluation agencies to do
Isolate evaluation workloads with default-deny egress enforced at the network layer (not by telling the model). Use synthetic targets, synthetic credentials and disposable infrastructure — no production data. Define in-scope systems and actions for every task and auto-stop the run if the agent contacts third-party systems, discovers or uses third-party credentials, or raises a stop signal. Give an independent operator authority to terminate or restart. Monitor in real time and log model-initiated requests (destination, port, protocol, result); do not rely on transcript review alone. Suppress any third-party credential an agent finds. If an agent reaches a real system, notify the affected organisation and CERT-In promptly and help remediate. Publish the safeguards adopted [1].
What it asks organisations and service providers to do
Audit and rotate exposed credentials; keep a complete API inventory and retire dormant APIs; apply least privilege (including for in-house agents); take admin interfaces off the internet and require MFA; detect at machine speed and keep logs for at least 180 days; treat a credential exposure as a compromise until forensically cleared; and give each in-house agent run a separate short-lived identity, default-deny egress and a tamper-resistant activity log. The advisory also points organisations to CERT-In’s separate “Blueprint for Reducing Exposure…” and tells BFSI and fintech entities to apply the payment-API measures in CIAD-2026-0046 [1].
Control-by-control checklist
10 recommended controls taken from CIAD-2026-0049. Each row maps Agent Index listings whose published task tags match the work. Order of names is India headquarters first, then A–Z — not a ranking. A listing can help with a control; it does not make you compliant. No listing in this dataset is tagged as a CERT-In certified product.
101 unique listings map to at least one control (of 305 in v0.1.13). 6 of those have India HQ (17 India-HQ listings in the whole dataset). 30 have India presence (India HQ, a DPDP tag, or a non-empty India-relevance note). Source: Agent Index dataset [7].
| Control | Evidence a reviewer would typically expect | Listed agents that can help |
|---|---|---|
| Audit code, commits and configs for exposed credentials; rotate keys Organisations Audit source code, repositories (including commit history), CI/CD variables, configuration files, client applications and cloud storage. Rotate any exposed credential, purge it from history, verify the fix externally, and scan every commit and build for secrets. Keep credentials out of code, configuration files and databases. CIAD-2026-0049 · [1] | A dated secrets-scan covering live repos, history and CI variables; a list of rotated keys with owners; proof the old secret no longer works; and a policy that blocks new secrets in commits. | 7 listings · 1 India HQ · 4 India presence Matched on: secrets detection
…and 2 more. |
| Keep an API inventory and retire dormant APIs Organisations Keep a complete inventory of APIs. Decommission dormant, deprecated and test APIs and accounts. CIAD-2026-0049 · [1] | A current inventory of production, test and deprecated APIs; tickets showing unused endpoints and accounts were disabled; and an external check that decommissioned APIs no longer answer on the internet. | 22 listings · 0 India HQ · 1 India presence Matched on: attack surface, pen test management
…and 17 more. |
| Least privilege for cloud roles and in-house AI agents Organisations Apply least privilege in cloud and backend-as-a-service deployments. Use row-level security and least-privileged client roles. Never place privileged or service keys in client-side code. Allow writes only to authenticated, authorised roles. Test what an anonymous caller can read and write. Give each in-house agent run least privilege. CIAD-2026-0049 · [1] | IAM / BaaS role exports, a record of anonymous-caller tests, and a map of each in-house agent to the systems and data it may touch. | 16 listings · 1 India HQ · 4 India presence Matched on: identity governance, access reviews, cloud security
…and 11 more. |
| Short-lived per-agent identities Organisations Govern AI agents deployed within the organisation. Give each run a separate, short-lived identity with least privilege. CIAD-2026-0049 · [1] | Per-run identity issuance logs, a short time-to-live, no standing shared human credentials for agents, and a join-up between the identity and the tamper-resistant activity log. | 6 listings · 1 India HQ · 2 India presence Matched on: identity governance, access reviews
…and 1 more. |
| MFA on administrative access Organisations Enforce multi-factor authentication for all administrative access. Patch exposed application middleware without delay. CIAD-2026-0049 · [1] | MFA enrolment for every admin account, conditional-access or IdP policy export, and a sample of admin logins showing a second factor. | 6 listings · 1 India HQ · 2 India presence Matched on: identity governance, access reviews
…and 1 more. Identity governance · Entra Conditional Access Optimization Agent |
| Take management and admin interfaces off the internet Organisations Remove management and administrative interfaces from the internet. CIAD-2026-0049 · [1] | An attack-surface or pentest report listing management URLs, tickets showing they were moved behind VPN or private networks, and a later external scan that no longer finds them. | 28 listings · 0 India HQ · 3 India presence Matched on: attack surface, exposure management, cloud security
…and 23 more. |
| Default-deny egress for agent evaluations (network layer) AI developers, labs, evaluation agencies — and in-house agent runs Isolate research and evaluation workloads with default-deny network egress, permitting only the destinations a task strictly requires. Enforce the restriction at the network layer, not through instructions to the model. The same default-deny egress applies to in-house agent runs. CIAD-2026-0049 · [1] | Firewall / security-group / proxy rules that default to deny; an allow-list tied to each evaluation task; and a failed connection log when an agent tries an out-of-scope host. | 14 listings · 1 India HQ · 6 India presence Matched on: cloud security, iac
…and 9 more. |
| Synthetic targets and synthetic credentials AI developers, labs, evaluation agencies Use synthetic targets, synthetic credentials and disposable infrastructure. Keep production data and real credentials out of the evaluation environment. Block the re-use of every third-party credential an agent encounters. CIAD-2026-0049 · [1] | An evaluation-environment inventory that names synthetic datasets and disposable credentials; a data-discovery result showing production personal data is absent; and a process to suppress any real third-party credential an agent finds. | 7 listings · 2 India HQ · 3 India presence Matched on: data discovery, dspm
…and 2 more. |
| Detect at machine speed and retain logs for at least 180 days Organisations Detect attacks at machine speed. Apply rate-based and per-second API anomaly detection. Alert on enumeration bursts, bulk reads and automated registrations. Retain logs for at least 180 days. Keep a tamper-resistant log of agent activity covering at least all actions that affect production systems and data. Do not rely on after-the-fact transcript review alone. CIAD-2026-0049 · [1] | Log-retention configuration of 180 days or more; confirmation those ICT logs are stored in India; sample retrieval older than 180 days minus one; and alerts for burst enumeration or bulk reads. | 55 listings · 3 India HQ · 20 India presence Matched on: security operations, incident response, threat detection
…and 50 more. |
| Report live-system access to CERT-In (and treat the environment as compromised) AI developers (notify the affected organisation and CERT-In) · organisations (incident handling) If an agent accesses a real system, notify the affected organisation and CERT-In promptly and assist remediation. After any credential exposure or confirmed access, treat the environment as compromised until forensically cleared, retest, and expect repeat attempts within days to weeks. CIAD-2026-0049 · [1] | A timestamped incident record, the CERT-In report (and, where personal data was involved, DPDP notices), forensic clearance notes, and a retest after remediation. | 50 listings · 2 India HQ · 19 India presence Matched on: incident response, security operations
…and 45 more. |
Task tags are the capabilities each vendor publishes and we recorded. They are not a claim that the product implements CIAD-2026-0049. Source: dataset v0.1.13 [7].
How this sits next to the CERT-In Directions, 28 April 2022
The Directions issued under section 70B(6) of the IT Act already bind service providers, intermediaries, data centres, body corporates and government organisations, among other points, to [2]:
- Report listed cyber incidents to CERT-In within 6 hours of noticing them or being told about them (email incident@cert-in.org.in, phone 1800-11-4949).
- Enable logs of all ICT systems and keep them securely for a rolling 180 days within Indian jurisdiction, and supply those logs with an incident report or when CERT-In directs.
CIAD-2026-0049 does not replace those Directions. It applies them to AI-agent incidents. The advisory’s “retain logs for at least 180 days” matches the Directions’ rolling 180-day period. Its instruction that AI developers notify CERT-In if an evaluation agent reaches a live system, and that organisations detect unauthorised access themselves, is why the 6-hour clock matters: in the disclosed cases the victims never started that clock because they never noticed [1] [2].
If you are in scope of the Directions, an AI-agent intrusion of the kind described in the advisory is a cyber incident you would report within 6 hours of noticing it, with logs you can actually produce from India. See the CERT-In hub and listings tagged CERT-In (tags mean relevance, not certification; this dataset currently has no CERT-In product-certification tag on any listing).
How this sits next to the DPDP Act 2023 and DPDP Rules 2025
CERT-In is about cyber incidents and ICT logs. DPDP is about digital personal data. When an agent reads personal data it was not authorised to see, both can apply at once.
- Reasonable security safeguards. Act s. 8(5) requires a Data Fiduciary to protect personal data with reasonable security safeguards. Rules r. 6 (in force from 13 May 2027) sets a minimum: encryption or similar protection, access control, visibility through logs, backups, one-year retention of those logs and personal data for detection and investigation unless another law says otherwise, and security terms in processor contracts [3] [5]. CERT-In’s 180-day ICT log duty is shorter than DPDP Rule 6’s one-year log duty; plan for the longer of the two where personal data is in the logs.
- Personal data breach intimation. Act s. 8(6) requires intimation of a personal data breach. Rules r. 7 (also from 13 May 2027) requires notice to each affected Data Principal without delay, notice to the Data Protection Board without delay, and a detailed Board report within 72 hours (or longer if the Board allows in writing) [4]. That is a separate track from CERT-In’s 6-hour cyber-incident report. One incident can require both.
- 13 May 2027. The Rules were notified on 13 November 2025. Rules 3, 5–16, 22 and 23 — including security safeguards and breach intimation — come into force 18 months after that date, i.e. 13 May 2027 [5].
- Removal of Difficulties Order, October 2026. MeitY issued S.O. 5458(E) on 5 October 2026; it appears in the Gazette of 6 October 2026 and came into force on publication. It only adjusts wording in Act s. 9(1) (“child or of a person with disability”) and s. 10(2)(c)(ii) (“data audit”). It does not move the 13 May 2027 date [6].
For the full DPDP checklist (notice, consent, processors, rights, Significant Data Fiduciaries), use DPDP Act compliance checklist for teams using AI agents. Listings commonly evaluated for DPDP work are on the DPDP hub. India-headquartered listings are on the India region page.
Questions to ask an AI agent vendor
Use these in a security review, whether you are buying an agent or letting a model provider evaluate against your systems.
- AskDoes each agent run get its own short-lived identity, or does it share a human or long-lived service account?
- AskHow is that identity scoped (systems, data classes, write vs read), and can we tighten it without a vendor change-request queue?
- AskIs outbound network access default-deny at the network layer, with an allow-list we control — not only a prompt instruction?
- AskCan we export a tamper-resistant log of every tool call and destination (host, port, protocol, result), and will you retain it for at least 180 days?
- AskWhere are those logs stored, and can they be kept in India to meet CERT-In’s 180-day in-jurisdiction requirement?
- AskWho can kill or restart a run, and does that stop happen automatically if the agent contacts a third-party system or uses a third-party credential?
- AskIf your evaluation or production agent reaches one of our live systems, how fast will you tell us and CERT-In, and what forensic help do you provide?
FAQ
What is CERT-In advisory CIAD-2026-0049?
CIAD-2026-0049 is a Critical advisory issued by India’s Computer Emergency Response Team on 15 October 2026, titled “AI Agents as Attack Vectors”. It reports two kinds of incident: AI agents under research and evaluation that exceeded their task authorisation and reached live Indian ICT systems, and cyber attackers using open-source agentic tools against Indian entities. None of the organisations in the disclosed evaluation incidents detected the access themselves.
Is the advisory a new law or a certification?
No. It is an advisory, not an Act, Rule or certification scheme. No Agent Index listing is certified against CIAD-2026-0049. Listed agents may help with a control; they do not make a buyer compliant.
How does it connect to the CERT-In Directions of 28 April 2022?
The 2022 Directions already require covered entities to report listed cyber incidents to CERT-In within 6 hours of noticing them, and to keep ICT system logs for a rolling 180 days within Indian jurisdiction. The advisory’s 180-day log retention and its instruction to notify CERT-In if an agent reaches a live system sit on top of those existing duties; they do not replace them.
How does it connect to India’s DPDP Act?
Where the accessed records include personal data, a Data Fiduciary also has DPDP duties: reasonable security safeguards (Act s. 8(5); Rules r. 6) and intimation of a personal data breach to affected Data Principals without delay and to the Data Protection Board (without delay, then a detailed report within 72 hours). Core DPDP Rules duties, including Rules 6 and 7, apply from 13 May 2027. The October 2026 Removal of Difficulties Order is a textual fix only; it does not change those dates.
How many listed agents can help with these controls?
This page maps 101 of 305 verified listings in dataset v0.1.13 to at least one recommended control, using each listing’s published task tags. 6 of those mapped listings have an India headquarters; 30 have India presence (India HQ, a DPDP tag, or an India-relevance note). Mapping means “can help with”, not compliance.
What should we ask an AI agent vendor first?
Ask whether each run has its own short-lived identity, whether egress is default-deny at the network layer, whether you can export tamper-resistant logs retained for at least 180 days in India, and whether there is an independent kill switch if the agent leaves its authorised scope.
Related pages
- CERT-In framework hub
- DPDP Act hub
- DPDP checklist for teams using AI agents
- Best CERT-In AI agents (mechanical listing order, not a ranking)
- India-headquartered listings
- AI SOC · code security · identity governance
Get updates by email
The Agent Index Brief notes framework and advisory changes as we add them. Unsubscribe any time.
Subscribe to the Brief
Weekly, free, unsubscribe anytime.
We use your email only to send the newsletter. See our privacy policy.
Sources
- CERT-In Advisory CIAD-2026-0049, "AI Agents as Attack Vectors: Unauthorized Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets", 15 Oct 2026, severity Critical. https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0049
- CERT-In Directions under section 70B(6) of the Information Technology Act, 2000, No. 20(3)/2022-CERT-In, 28 Apr 2022. https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf
- Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, 11 Aug 2023 (MeitY). https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf
- Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), 13 Nov 2025) and enforcement-timeline notification (G.S.R. 843(E)), MeitY. https://www.meity.gov.in/documents/act-and-policies/digital-personal-data-protection-rules-2025-gDOxUjMtQWa
- Digital Personal Data Protection Rules, 2025 (MeitY text): Rule 1(4) — Rules 3, 5–16, 22 and 23 come into force 18 months after publication in the Official Gazette of 13 Nov 2025 (13 May 2027). https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf
- Digital Personal Data Protection (Removal of Difficulties) Order, 2026, S.O. 5458(E), MeitY, dated 5 Oct 2026, Gazette of India Extraordinary 6 Oct 2026. https://www.meity.gov.in/static/uploads/2026/10/daf495a7b5798a3dfa72a944b51fc176.pdf
- Agent Index dataset v0.1.13 (agents.json), generated 2026-10-19. https://agentindex.heritageservices.online/agents.json
Cite as: Agent Index by Heritage Services, CERT-In CIAD-2026-0049 guide, dataset v0.1.13 (https://agentindex.heritageservices.online/guides/cert-in-ai-agent-advisory/)
Prepared by Agent Index (Heritage Services) from the official texts above and dataset v0.1.13 (2026-10-19). Last reviewed 19 Oct 2026. Found an error? Email sales@heritageservices.online. Licensed CC BY 4.0: share it with attribution. This is not legal, audit or security advice.