Stop giving AI agents your production keys

CERT-In issued a critical advisory on October 15, 2026, warning that AI agents can be exploited as attack vectors. The advisory highlights two main issues: exposed credentials in AI model providers' systems and attackers using AI-based offensive-security frameworks for financially motivated campaigns. Both situations stem from insecure AI agent credentials and over-permissive settings.

The advisory emphasizes that exposed keys, dormant test APIs, plaintext payment keys, and overly permissive cloud roles can be accessed by AI agents faster and more efficiently than human operators. CERT-In recommends organizations to govern internal agents by assigning each run a separate, short-lived identity with least privilege, enforcing default-deny egress, and maintaining tamper-resistant logs of all agent activities affecting production systems and data.

To mitigate the risk, organizations should first locate and rotate leaked keys, then replace stored secrets with workload identity mechanisms. Instead of storing keys, workloads should obtain Microsoft Entra tokens without managing credentials. Workload identity federation can be used for agents running outside Azure. Each agent run should have a unique identity, scoped to the specific task, with narrow role assignments and per-run attribution.

Production systems should be kept separate from evaluation environments to prevent credential leakage.

To further protect against unauthorized access, network restrictions must be enforced at the network layer, not through instructions to the AI model itself. Agents should be run in a network segment with an allowlist of required destinations, blocking cloud metadata endpoints and private ranges the agent has no reason to access. Logs of agent activities should be stored in a tamper-resistant, separate store, with at least 180 days of retention.