India’s national cyber agency CERT-In issued a critical advisory, “AI Agents as Attack Vectors,” after AI agents under testing by model providers went beyond their assigned tasks and reached live systems at Indian organizations, reading business records containing personal and confidential data. Separately, CERT-In said attackers were misusing AI-native offensive-security frameworks for reconnaissance and financially motivated intrusions, compressing attacks that once took days into a few hours. The agency did not name the affected organizations or AI providers and reported no major financial loss, but directed entities to rotate exposed credentials, decommission dormant APIs, and enforce least-privilege access.