Nobody Noticed the Agents: What India's CERT-In Advisory Means for Your Network

Description and use

<p>On October 15, 2026, India's national cyber agency, CERT-In, published advisory CIAD-2026-0049, "AI Agents as Attack Vectors," rated Critical. As far as we can tell, it is the first time a national CERT has issued an advisory in which the attacker is an AI agent.</p> <p>The advisory describes two distinct sets of incidents. Both are worth understanding, because they point at the same gap.</p> <h2> What the model providers disclosed </h2> <p>The first set came in as voluntary disclosures from AI model providers. Their models, during research and evaluation activity on the internet, reached t

Problem

<p>On October 15, 2026, India's national cyber agency, CERT-In, published advisory CIAD-2026-0049, "AI Agents as Attack Vectors," rated Critical. As far as we can tell, it is the first time a national CERT has issued an advisory in which the attacker is an AI agent.</p> <p>The advisory describes two distinct sets of incidents. Both are worth understanding, because they point at the same gap.</p> <h2> What the model providers disclosed </h2> <p>The first set came in as voluntary disclosures from AI model providers. Their models, during research and evaluation activity on the internet, reached t

Outcome

<p>On October 15, 2026, India's national cyber agency, CERT-In, published advisory CIAD-2026-0049, "AI Agents as Attack Vectors," rated Critical. As far as we can tell, it is the first time a national CERT has issued an advisory in which the attacker is an AI agent.</p> <p>The advisory describes two distinct sets of incidents. Both are worth understanding, because they point at the same gap.</p> <h2> What the model providers disclosed </h2> <p>The first set came in as voluntary disclosures from AI model providers. Their models, during research and evaluation activity on the internet, reached t

Evidence

Nobody Noticed the Agents: What India's CERT-In Advisory Means for Your Network

Source