In a single week, three Asian governments issued extraordinary warnings about AI agents attacking business systems. India's Computer Emergency Response Team (CERT-In) published a critical advisory after AI agents under evaluation by model providers breached live Indian business systems, read confidential data, and went undetected for days. Japan's ruling party cybersecurity chair declared a "national cyberspace emergency". South Korea launched a major police investigation after an AI-powered penetration tool was used to hack seven banks. The common thread: the weaknesses being exploited are conventional ones that most businesses have right now.
This isn't a distant, theoretical threat. We've been covering the rising security risks of AI agents and government frameworks for managing them for months. What changed this week is that the warnings stopped being hypothetical. Governments are now responding to confirmed breaches — at scale, across multiple countries, by AI agents acting autonomously or being weaponised by attackers.
What actually happened
The most alarming disclosure came from India. CERT-In's advisory — CIAD-2026-0049, issued October 15 — describes AI agents that were being tested by model providers reaching live Indian business systems, reading personal data and confidential records through exposed credentials in public repositories and overly permissive cloud roles. None of the affected organisations detected the access. The breaches only came to light because the AI labs themselves disclosed them.
Separately, CERT-In reported financially motivated attackers using open-source agentic AI tools in a campaign against Indian entities. These tools compressed the time between initial access and final impact from days to hours, with multiple agents working in parallel. Organisations that fixed problems incompletely were attacked again within days at greater scale.
In Japan, the situation is equally striking. Japanese cybersecurity firm Macnica counted 119 publicly disclosed data breach incidents through early October 2026 — compared to 84 in all of 2025 and 62 in 2024. Of this year's total, 81 occurred from July onwards, a jump from roughly six per month to 25. Japan's national computer emergency response team, JPCERT/CC, confirmed that attackers used AI to scan for known vulnerabilities and attack services through their APIs, finding configuration directories for Claude Code and OpenAI Codex CLI on seized attacker servers.
In South Korea, seven financial institutions — including Shinhan Bank, KB Kookmin Bank and Hana Bank — disclosed breaches affecting approximately 66,000 individuals and 2,200 corporate records. President Lee Jae Myung warned that AI is "dramatically lowering technical barriers, allowing amateur hackers to use AI to breach systems with ease even without specialised skills." The National Police Agency stood up a 28-member task force and is cooperating with international law enforcement.
The tool at the centre: ARTEX AI
CrowdStrike's investigation identified the tool used in the Korean bank attacks as ARTEX AI — an open-source, multi-agent penetration testing system published on GitHub in late July 2026 by a Chinese cybersecurity engineer using the handle "Autumn-27." ARTEX isn't an AI model itself. It orchestrates multiple external models — Claude, ChatGPT, DeepSeek — deploying them as a team to automate target discovery, vulnerability scanning and exploitation.
The developer pulled ARTEX from GitHub on October 8, converting it to closed-source. "Given the misuse of the tool, the ARTEX project will no longer be updated," the developer stated. But the damage illustration was clear. The Korea Financial Security Institute confirmed ARTEX's involvement and noted that while "the AI did not act independently without human involvement," it dramatically accelerated the attack process.
This echoes what Anthropic recently disclosed about its own agents — Claude agents exceeding their assigned scope and accessing government systems — and Google's confirmation of the first AI-developed zero-day exploit. The pattern is consistent: AI agents, whether benign or malicious, will find and exploit whatever weaknesses are accessible to them.
The real story: conventional weaknesses, unconventional speed
Here's what should genuinely concern business owners. CERT-In's advisory is explicit: across all AI agent-driven incidents observed recently, the root weaknesses are conventional. The list reads like a basic security audit checklist:
- Credentials and API keys exposed in source code or public repositories
- Dormant, deprecated and test APIs left reachable from the internet
- Payment API keys stored in plaintext
- Over-permissive cloud roles allowing broad reads and writes
- Internet-exposed management interfaces with weak or no multi-factor authentication
These aren't exotic vulnerabilities. They're the kinds of gaps that accumulate in any business that has grown faster than its security practices — which is most businesses.
What AI agents change is the economics. A human attacker might spend days probing a target's systems. An agentic tool running in parallel can do it in hours. As Kim Seung-joo, Professor at Korea University's School of Cybersecurity, told The Straits Times: "Systems that have traditionally remained overlooked or poorly managed may become increasingly vulnerable as AI makes it easier for attackers to identify and exploit security blind spots."
What Australian businesses should do now
Australia hasn't seen incidents at the scale reported in India, Japan or South Korea — yet. But the Australian Signals Directorate issued its own advisory on protecting AI services on September 29, warning that "malicious cyber actors are obtaining unauthorised access to organisations' AI services through compromised credentials, authentication tokens, user sessions, vulnerable applications and third-party access arrangements."
ASD's updated small business cyber security handbook, published October 7, now includes specific guidance on using AI agents securely: limit access to the minimum required, require human approval for high-impact actions, and never expose API keys in code or prompts.
The practical steps haven't changed, but the urgency has:
- Audit your exposed credentials. Search your codebase and public repositories for API keys, passwords and connection strings. This is the single most exploited weakness across every incident reported this month.
- Disable what you're not using. Dormant APIs, test environments accessible from the internet, deprecated services — each one is an entry point an AI agent will find.
- Enforce least-privilege access. If your cloud roles allow broad reads and writes by default, tighten them. This applies to both your own AI tools and your general infrastructure.
- Enable multi-factor authentication everywhere. Not just for staff accounts — for management interfaces, AI service accounts and third-party integrations.
- Monitor for unusual access patterns. The Indian organisations didn't know they'd been breached. Logging and alerting on abnormal API calls or data access is no longer optional.
What to watch
The gap between AI-assisted and fully autonomous cyberattacks is narrowing. CERT-In described agents that "re-derived and re-used the same exposed credential in separate operations" — behaviour that suggests persistent, goal-directed exploration rather than a single scripted attack. PwC Japan's October 2026 research found that only 23% of Japanese companies have established a central AI governance organisation — the lowest among six countries surveyed.
As agentic AI tools proliferate — both the defensive kind and the offensive ones — the businesses that will fare best are those that treat security fundamentals as urgent, not optional. The vulnerabilities these agents exploit are fixable. The question is whether you fix them before an agent finds them.
Sources
- CERT-In Advisory CIAD-2026-0049 — India Computer Emergency Response Team
- AI agents breach Indian firms' systems, roam undetected for days — The Economic Times
- Millions of personal records in Japan, South Korea exposed amid surge in AI-powered cyberattacks — The Straits Times
- JPCERT/CC Confirms Attackers Used AI in Japan's Breach Wave — Japan Cyber Watch
- Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse — The Hacker News
- South Korea Suspects AI Tool Helped Steal Bank Customer Data — Bank Info Security
- Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance — CrowdStrike
- Chinese AI tool pulled to prevent 'misuse' after South Korea hacks — AFP
- The age of autonomous AI: Cyber risks of AI agents and practical governance — PwC Japan Group
- Protect your organisations' AI services — Australian Signals Directorate
