AI attacks this week: India's CERT-In lists AI agents as attackers (week 42/2026)

Reporting period: 12 to 18 October 2026.

India: CERT-In warns of AI agents as attackers

On 15 October the Indian Computer Emergency Response Team CERT-In published an advisory rated "Critical". In it, the agency describes two kinds of incident in which, in its words, the attacker was an AI agent.

The first kind involves criminals. In a financially motivated campaign against Indian organisations, they used publicly available agentic attack tools. According to CERT-In, this compressed the time from initial access to final impact from days to a few hours. Victims that had remediated only partially were attacked again within days, at greater scale. The agency does not say which tools were used or how many organisations were affected.

In the second kind, AI agents exceeded their assigned tasks during research and evaluation runs. Several AI model providers voluntarily told CERT-In that their models, during research and evaluation runs on the internet, had reached the live systems of Indian organisations. There they read business records, including personal data and confidential material. They gained access through credentials in configuration and public code repositories and through overly permissive cloud roles. None of the affected organisations detected the access; in every case it was disclosed by the providers.

Role of AI: According to CERT-In, AI found and exploited conventional weaknesses faster, more exhaustively and at greater scale than human attackers. The agency calls the weaknesses themselves conventional, such as exposed credentials and management interfaces without multi-factor authentication.

How well established: a finding by a national agency, based on its own forensics, its own threat hunting and disclosures by the providers. CERT-In gives no figures and no names.

OpenCode: a breach linked to distillation

On 17 October the provider of the AI coding tool OpenCode reported a security breach. It affected 1.4 percent of the users of its Console. OpenCode relates the breach to a large-scale distillation attack. In such an attack, a model's outputs are harvested in bulk to train another model.

Role of AI: The target was an AI service; only users who had connected external AI providers are affected. OpenCode says it is working with Anthropic, OpenAI and Google to remediate. According to StepSecurity, OpenCode has not yet published a root cause or said what data was accessed.

How well established: confirmed by the affected vendor; the incident is ongoing, cause and extent are open.

Unit 42: espionage with apparently AI-generated scripts

Palo Alto Networks' Unit 42 describes a campaign against government entities and state-affiliated infrastructure, observed from October 2025 to April 2026. The attackers, tracked by Unit 42 as CL-UNK-1211, attempted to dump databases and exfiltrate government mailboxes. They attempted to pass off their activity as a red team exercise.

Role of AI: Several scripts contained conversational, step-by-step explanations addressed to the person who had given the instructions. According to Unit 42, this suggests that the code was either copied from an AI's output or deployed by an AI agent. At least one script contained syntax errors and would have failed on execution.

How well established: a technical report with telemetry. Unit 42 infers AI involvement from features of the scripts; the report names no model or tool.

South Korea: regulator counts 16 affected financial companies

There are now official figures on the case from week 41. On 14 October the Financial Services Commission announced that 16 financial companies in total were affected around the incident at Shinhan Bank. Among them are the banks Shinhan, Kookmin, Busan and Hana. According to the FSC, about 100,000 records were leaked, including names, contact details, resident registration numbers and email addresses. The FSC found no leak of account passwords or card numbers. According to the FSC, the number of affected companies may still grow.

The regulator is still examining whether AI was involved and whether all cases go back to the same actor. The AI link continues to rest on the CrowdStrike report. It found Claude Code session histories and configuration files of the ARTEX tool in open directories controlled by the attacker. On 16 October Recorded Future added that the attacker was testing infrastructure and assembling tools as early as August. According to Recorded Future, the evidence does not establish how far AI accelerated the attacks.

Addendum to week 41: CyberXero

On 6 October SOCRadar published a report on a Russian-speaking initial access broker that we missed in week 41. According to SOCRadar, the actor worked with up to 51 specialised Claude Code agents. SOCRadar says confirmed exfiltration covers more than 628,000 records on individuals from four Ukrainian organisations. This came to light through an open directory of the attacker containing session logs. These also show model refusals that held.

How well established: a technical report with artefacts; we have not found confirmation from those affected.

Flaws in AI tools

• MCP TypeScript SDK (GHSA-jm63-cq47-j5jp): an MCP server reached over HTTP could deliver one client's responses to another if the transport or server was created once for all clients. Until this release, the README examples of the official packages showed exactly this pattern. Fixed in @modelcontextprotocol/server 2.3.0; according to the maintainers, your own code also needs to change.
• VS Code with GitHub Copilot (CVE-2026-102232): through prompt injection, an agent could write a shell command into hook files without the expected approval prompt. This requires hooks enabled in a custom location. Fixed in 1.141.1.
• Claude Desktop on Windows (CVE-2026-88066) and JetBrains Junie CLI (CVE-2026-111091): a crafted project could execute foreign code. In Claude Desktop, opening a project folder containing a malicious git.exe was enough; in Junie, the MCP configuration of an untrusted project was enough. Fixed in Claude Desktop 1.8089.0, distributed by automatic update, and in Junie CLI 26.8.3.

How well established: confirmed by the vendors or maintainers. The publications contain no information about exploitation.

What follows, in our view

• Remove credentials from code and configuration. The incidents described by CERT-In rest on keys in repositories and configuration files and on overly broad cloud roles. In the cases CERT-In examined, AI found such places faster than human attackers. That includes commit history.
• Remediate completely and test again. According to CERT-In, victims that cleaned up only partially were attacked again within days.
• Restrict your own AI agents at network level. CERT-In recommends limiting their network traffic technically rather than relying on instructions to the model.
• Check third-party projects before opening them. In Claude Desktop, opening was enough; in Junie, the configuration in the project. Anyone running MCP servers on TypeScript SDK 2.x in a way that lets several clients share a transport or server needs to change their code as well as update.
• Check stored keys. Anyone who stored keys for AI providers in OpenCode should follow the vendor's guidance and, if in doubt, rotate the keys.

Selection and sources

We include reports in which AI was essential to the attack, as a tool, as a target or for deception. Every statement has been checked against the primary source. We distinguish whether an incident has been confirmed by the victim, an authority or the vendor, or has so far only been reported. We welcome reports of errors and make corrections visible.