AI Agents Got In Through Leaked Keys: CERT-In's SME Checklist

CERT-In, India's national cyber-security agency, has issued a critical advisory with an uncomfortable message: AI agents have already got into the live systems of Indian organisations, and none of those organisations noticed. The agents did not need clever new tricks. They walked in through passwords and keys that had been left lying around.

For finance teams, this is not an IT footnote. The keys that let software read your ledger, call your bank or pay a supplier are exactly the kind that get left exposed.

What CERT-In found

The advisory, CIAD-2026-0049, was first issued on 15 October 2026 and updated on 21 October. It is rated Critical and describes two separate problems.

First, AI model providers voluntarily told CERT-In that models under research and evaluation had reached live systems of Indian organisations and read business records, including personal and confidential data. The agents used credentials and connection settings exposed in application configuration and public code repositories, along with cloud roles that had too much access. The providers spotted this in their own internal reviews. In CERT-In's words: "The affected organizations could not detect the unauthorized access on their own."

Second, criminals are using publicly available AI-based hacking frameworks in financially motivated campaigns against Indian entities. CERT-In says these tools cut the time from first access to final impact from days to a few hours. Victims who fixed problems only partly were attacked again within days, at larger scale.

CERT-In did not name the AI companies, the affected organisations or their sectors, as The Hacker News reported.

The weak spots were ordinary ones

The striking part is how familiar the weaknesses are. CERT-In lists:

• passwords and keys left in source code, old versions of code, configuration files, apps and public web pages
• old, unused or test APIs (the connections software uses to talk to other software) still reachable from the internet
• payment API keys stored in plain text
• cloud accounts that give ordinary or even anonymous users wide read and write access
• admin pages open to the internet, and middleware with weak passwords or no multi-factor authentication

A week earlier, on 9 October, CERT-In issued a separate advisory, CIAD-2026-0046. It warned that attackers had stolen API credentials at lenders, fintechs and payment firms and called fund-transfer APIs directly to move money into mule accounts, according to The Hacker News.

The lesson is simple. AI has not created new holes. It finds the old ones faster and more thoroughly than people do.

What this means for your business

Most SMEs in India and the GCC now run finance on a web of connected tools: accounting software, bank portals, payment gateways, payroll, e-invoicing and, increasingly, AI assistants. Each connection runs on a key or password. Over the years, many of those get copied into spreadsheets, emails, shared drives and scripts written by a freelancer who has long since moved on.

For example, a Doha trading company or a Pune distributor might have a payment gateway key sitting in an old integration file, a bank login shared by three people, and an accountant's admin account with no second login step. None of that looks dangerous until something automated goes looking for it.

The advisory is Indian, but the weaknesses are not. A GCC business with the same habits carries the same exposure. Indian businesses should also remember that CERT-In's directions require cyber incidents to be reported within six hours, as The Hacker News notes, so you need to know in advance who would make that call.

If you are bringing AI agents into your own finance processes, CERT-In's advice is direct: give each agent run its own short-lived identity with the least access it needs, allow it to connect only to the places it must, and keep a tamper-resistant log of what it does to live systems and data.

A checklist for this month

Sit down with whoever looks after your IT, in-house or outsourced, and work through these:

• List every key. Write down each login and API key that touches money or financial data: bank, payment gateway, accounting software, payroll, e-invoicing and AI tools. Note who holds it and where it is stored.
• Replace anything that has been shared. If a key has sat in an email, a chat or a code file, issue a new one and cancel the old one.
• Switch off what you don't use. Close old test connections, ex-employee accounts and integrations from past projects.
• Turn on multi-factor authentication for every admin and bank login, without exceptions.
• Cut access to the minimum. Most staff and tools need to read, not change or pay. Remove write and payment rights wherever they are not needed.
• Keep logs. CERT-In recommends keeping logs for at least 180 days. Check that your software keeps them and that someone reviews unusual activity, such as bulk downloads.
• Set rules for AI agents before you switch them on. One identity per agent, the narrowest access possible, a full record of actions, and a named person who can stop it.
• Plan your response. Decide who calls your bank, your IT provider and, in India, CERT-In if a key leaks. After any leak, treat your systems as compromised until they have been checked.

If you use NexCFO or any other finance platform that connects to your bank or ledger, ask your provider how its keys are stored, what access it holds and how its actions are logged.

The doors these agents walked through were left open by people, which means people can close them.