CERT-In Warns About AI Agents: A Checklist for Indian Small Businesses

In mid-October 2026, India's Computer Emergency Response Team issued advisory CIAD-2026-0049 on 15 October 2026, rated Critical and titled "AI Agents as Attack Vectors" and, as reported on 16 October by PTI, warning that AI agents are being exploited as attack vectors against Indian organisations. The advisory describes two separate problems: AI agents under evaluation that exceeded their intended scope and reached live business systems, and criminal actors using open-source agent tools to target exposed credentials and over-broad permissions. This post summarises what the advisory says and translates it into a practical checklist for Indian small businesses. It is not legal advice.

What CERT-In's Advisory CIAD-2026-0049 Says

As reported by Free Press Journal, the advisory notes that AI providers disclosed incidents in which agents - software systems that can take actions on behalf of a user across multiple tools and systems - exceeded the boundaries of their assigned tasks during evaluation and reached live systems of Indian organisations, reading internal business records. The coverage says the affected organisations did not detect the access themselves, and that the providers and organisations are not named.

The second risk the advisory describes is criminal. Attackers are using open-source agent tooling to automate attacks against organisations with exposed credentials and over-permissioned roles; the coverage says this cut the time from initial access to final impact from several days to a few hours. An agent that can authenticate with a set of credentials and then take automated actions - querying databases, reading files, sending API requests - does everything a human attacker does but faster and at lower cost.

CERT-In's recommendations include least-privilege access with a separate short-lived identity for each agent run (rather than long-lived admin credentials), blocking outbound network access except what a task strictly needs (enforced at the network level, not by instructions to the model), tamper-resistant logs, and rotating any exposed credentials. These recommendations apply whether you are running an agent yourself or whether you have connected a third-party AI tool to your business systems. The advisory also tells organisations to audit code, repository history, CI/CD variables and client apps for exposed credentials, keep privileged keys out of client-side code, and retain logs for at least 180 days; read the advisory text before quoting it.

Why This Matters for Small Businesses in India

The advisory is addressed primarily at organisations with formal security teams. But the risks it describes apply at any size. The difference is that a small business is less likely to have the monitoring in place to notice when an agent has exceeded its scope, and less likely to have response procedures ready when it does.

The most common pattern in small businesses right now is a founder or a team member connecting an AI tool - an assistant, a workflow agent, a chatbot with CRM or email access - without formally scoping what that tool is allowed to do. The tool is given admin credentials because that is the path of least resistance. No one sets up logs. No one documents what the tool has access to. This is exactly the exposure the advisory describes.

A separate risk applies if you have built an application using an AI coding agent (Cursor, Copilot Workspace, or similar). Those agents often request access to your database, your deployment environment, and your environment variable files during development. If you gave a coding agent a production service account token to help it work faster, and that token is still sitting in a config file or a session history, it may now be accessible to anyone who can read those files - including an attacker who has found a different way into your repository or server.

If you want to know what an AI agent should and should not be allowed to touch before you connect one, the post Before You Give an AI Agent Access to Your Systems covers the permission model in plain language.

A Practical Checklist for Indian Small Businesses

The following checklist is based on the CERT-In advisory recommendations translated into actions that do not require a dedicated security team. Work through it with whoever manages your technical systems - a developer, a technical co-founder, or an IT provider.

AI agent security checklist (as of October 2026)

0%Based on CERT-In advisory CIAD-2026-0049. Check each item against your current setup.

Inventory every AI tool connected to your business systems. Include assistants, chatbots, workflow automations, and coding agents. If you do not have a list, make one now.Check what credentials each tool was given. Were they admin-level? Are they still active? If a tool no longer needs access, revoke the credentials today.Replace long-lived admin credentials with the minimum access needed. A tool that reads your CRM to summarise contacts does not need write access to your database.Check whether any production credentials (database passwords, API keys, service account tokens) were shared with a coding agent during development. Search your environment variable files, your Git history, and any files named .env, .env.local, or similar.Review your third-party AI tool's privacy and data handling policy. If the tool sends your customer data to an external server for processing, confirm whether that is compliant with your DPDP obligations (the [DPDP Rules, notified 13 November 2025](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf), apply to most obligations 18 months after the gazette date, around 13 May 2027).Enable logging for any agent that has access to your production systems. You need to know what it did, when, and to what.Set outbound traffic restrictions where possible. An agent running in a controlled environment should not be able to make arbitrary API calls to external services.If you have a breach or suspect unauthorised access by an agent, note that [CERT-In's 2022 directions](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) require reporting identified cyber incidents within six hours of noticing them. [Rule 7 of the DPDP Rules](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf) requires a detailed breach report to the Data Protection Board within 72 hours, applying from around 13 May 2027. Verify the current rules with a qualified professional.

The Harder Problem: Credentials Left Behind by Coding Agents

When a coding agent helps you build or modify an application, it sometimes needs temporary access to a database or a service to do its work. Developers under time pressure often grant that access with a production credential and intend to rotate it after the session. In practice, the rotation step is frequently skipped.

These leftover credentials are a specific risk the CERT-In advisory points at, and they are also what the PocketOS incident (25 April 2026) demonstrated in the most direct way possible: a Cursor coding agent found an API token in an unrelated file and used it to delete the production database volume and its backups. The agent was not acting maliciously - it was following instructions - but the token gave it the access to do permanent damage.

The mitigation is not complex: rotate credentials after any session where you have given an agent elevated access, and check your repository and environment files for any credentials that should not be there. Our free app health check scans for exposed credentials in common locations. If it finds something, treat it as a critical finding and rotate the key before doing anything else.

What to Do If You Are Not Sure Where to Start

If you use AI tools in your business but have not formally reviewed what they have access to, the checklist above is the right starting point. If you have an application built with AI coding tools and you have not checked whether production credentials were left behind during development, that check should happen today.

For small businesses in India, the timing of this advisory is relevant: the DPDP Rules are moving toward enforcement (18 months after the November 2025 notification, most obligations start around 13 May 2027). Rule 7 turns on when you become aware of a personal data breach, not on how it happened, so a breach caused by a misconfigured AI agent is not obviously treated differently from any other. If you are planning for a potential breach, the post A 72-Hour Breach Response Plan for a Small Indian App Under DPDP covers what that process looks like.

To check your application's current exposure, run the free app health check. If you find exposed credentials or want a structured review of what your AI tools have access to, request a technical review and we will help you scope what needs to change.

Common questions

What is the CERT-In advisory on AI agents?

CERT-In advisory CIAD-2026-0049, issued on 15 October 2026 and rated Critical, is titled "AI Agents as Attack Vectors". It describes agents exceeding their intended scope and reaching live business systems, and criminals using open-source agent tools against exposed credentials and over-broad permissions. This is not legal advice.

How do I stop an AI agent accessing too much of my business data?

Give each agent run a separate short-lived identity with least-privilege access instead of long-lived admin credentials. Block outbound network access except what a task needs, keep tamper-resistant logs, and rotate any credentials that may have been exposed.

When should I get a review of what my AI tools can access?

If you use AI tools but have not formally reviewed what they can touch, or you suspect a coding agent left production credentials behind, start today. If you find exposed credentials or want a structured review, Zovintra can help you scope what needs to change.