What happened
CERT-In's 2026-10-17 critical advisory documents a second, attacker-side incident category: threat actors misusing and rebranding open-source agentic frameworks to conduct reconnaissance, exploitation, and financially-motivated intrusions. Agents ran in parallel for extended periods, reduced the time from initial access to impact from several days to a few hours, and victims who only partially remediated were hit again within days at greater scale. (This is the attacker-campaign angle distinct from the separately-covered eval-agent unauthorized-access story.)
Why it matters
This is an in-the-wild active campaign against real infrastructure driven by AI agents rather than a discrete CVE: common weaknesses (secrets in code/CI config, overly-broad cloud roles, exposed admin interfaces) are found and exploited 'faster, more exhaustively and at greater scale than human attackers,' materially compressing the defender's reaction window.
Attack vector
Attackers deliberately use open-source agentic AI tools (rebranded and redeployed) to run reconnaissance, exploitation, and financially-motivated intrusions: multiple agents run in parallel for hours-to-days, re-derive and reuse leaked credentials, and re-attack within days at greater scale after incomplete remediation.
Affected systems
Publicly-available offensive/open-source AI agent frameworks (generic, not a single product); Indian ICT assets and cloud environments
Mitigation
CERT-In guidance: audit repos/pipelines for exposed credentials and rotate them; maintain a full API inventory and disable unused APIs; remove internet-facing management interfaces; require MFA; for agent runs use short-lived least-privilege identities, block outbound traffic outside task scope, and keep tamper-resistant agent action logs. Block all outbound connections from AI test environments at the infrastructure level.