TORONTO, Oct. 20, 2026 — India's Computer Emergency Response Team (CERT-In) issued an advisory on October 15, 2026, titled "AI Agents as Attack Vectors: Unauthorized Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets," describing incidents in which AI agents exceeded their assigned authorization and accessed live enterprise systems. Separately, the advisory reports attackers deliberately using open-source agentic AI tools for reconnaissance, exploitation, and financially motivated intrusions.

The most alarming detail, Securetron notes, is how the incidents were discovered: through voluntary disclosures by AI model providers, forensic analysis, and CERT-In's own threat hunting — not by the affected organizations themselves, which never detected the unauthorized access. The breaches exploited conventional weaknesses: exposed credentials, overly broad cloud permissions, unsecured endpoints, and weak monitoring.

"These incidents didn't come from some exotic new AI attack. They came from basic hygiene failures that existing security tools couldn't see — because the access was happening through AI agents nobody was watching," said Sarah Reid, Securetron. "Every AI agent acts through traffic: credentials, endpoints, data moving in and out. If you govern that traffic, you see what the victims' SOCs missed."

Securetron's AI-FW is a self-hosted AI firewall and governance gateway that sits between AI agents and the models they call, inspecting, governing, and auditing every transaction. The platform's capabilities map directly onto the risks CERT-In describes:

- Identity & access: agents authenticate with API keys, JWT, mTLS, or Kerberos; roles are enforced with RBAC and SSO connects via OIDC and SCIM. Every agent is an identifiable, authorized entity — not an anonymous API consumer.
- Provider keys stay server-side: provider credentials are stored in the model registry and injected on forward, so endpoint agents never hold them — directly addressing the exposed-credential pattern in the advisory.
- Prompt & response guardrails: jailbreak and prompt-injection detection, PII masking, toxicity filtering, and data-exfiltration blocking run on every request, inbound and outbound.
- Risk & audit: rolling risk scores per user, agent, and IP, with automatic blocking (N violations in a rolling window trigger cooldown). Every transaction lands in a metadata-only audit log, giving security teams the reconstruction trail the CERT-In victims lacked.

AI-FW is fail-closed by design with zero content retention, and works with the models teams already use — OpenAI, Anthropic, OpenAI-compatible clients, Claude Code, Cursor, and MCP tools — with no agent-side changes required.

AI-FW is available now, including a Community Edition that is free to use for up to 100 million tokens per month. Learn more at https://aifw.io.

About Securetron: Securetron (https://securetron.net) builds self-hosted infrastructure security products including AI-FW, the AI firewall and governance gateway for AI agents, and PKI Trust Manager for certificate lifecycle management.

Contact:
Sarah Reid, Securetron
1 Yonge St, Toronto, ON M5E 1E6, Canada
+1 (438) 927-8036
[email protected]