CERT-In’s AI agent warning: seven guardrails every business can use.
Around October 15, India’s national cyber agency CERT-In issued a critical advisory, CIAD-2026-0049, titled “AI Agents as Attack Vectors.” Its finding is uncomfortable: AI agents under testing reached live systems at Indian organisations and read business records, and none of the affected organisations noticed on their own.
- What happened: agents reached live systems using credentials left in code and over-permissive cloud roles.
- The root cause was ordinary: CERT-In says conventional security lapses sat behind every incident it saw.
- Attackers are using agents too, cutting the time from break-in to damage from days to hours.
- The fix is rules, not fear: scoped access, approvals, a log and a stop switch.
What CERT-In found
Seven guardrails that actually work
- Give every agent its own identity.Never a shared admin login. If it misbehaves, you can switch off one account.
- Grant the least access that does the job.A prospecting agent needs a list, not your finance system.
- Keep secrets out of code.No keys in configs or repositories. Rotate anything that ever was.
- Approve before anything leaves.Emails, posts, payments and record changes wait for a human until you trust the pattern.
- Log every action.What it read, what it wrote, what it sent. Someone reads the log weekly.
- Keep a stop switch.One control that halts every agent at once.
- Test on fake data first.CERT-In recommends synthetic targets and blocked outbound connections in test environments.
Guardrails in a ready-made AI operating system
| Guardrail | Do-it-yourself agents | Mercury OS |
|---|---|---|
| Identity per agent | Often one shared key | Each agent is a named role |
| Approvals | You build them | Owner-approved rules from day one |
| Action log | Optional | Run log for every agent |
| Stop switch | Rare | Kill switch on the board |
| Scope | Whatever the key allows | Each agent limited to its job |
Mercury OS was built this way because a business owner will only let agents work under their name if they can see and stop everything. For example, Studio drafts but new formats need your approval, and Maximus’s first message to a new lead waits for your yes.
Frequently asked questions
Does this mean AI agents are unsafe?
No. CERT-In’s own point is that ordinary security lapses were the root cause. Agents with scoped access, approvals and logs are manageable.
Does the advisory apply outside India?
It is an Indian advisory, but the weaknesses it describes, exposed keys and over-permissive roles, exist in every country.
What is the first thing to do this week?
List every AI tool and agent with access to your systems, and remove any shared or admin keys.
Mercury OS runs a team of AI agents under rules you approve, with a run log and a kill switch. Try it, or book a call to see how it is governed.
Sources: Deccan Chronicle; Inc42; TechEnclave.