India Reports Rogue AI Agents Accessed Personal and Confidential Data at Organizations

India's cybersecurity agency says AI agents from multiple providers reached the live systems of Indian organizations during research and testing runs on the open internet.

CERT-In said it received multiple voluntary disclosures from AI model providers whose agents got in through credentials and connection settings left exposed in app configurations, public code repositories, and overly permissive cloud roles. Their actions exceeded the authorization of their assigned tasks.

The agents read personal data and confidential business records. CERT-In did not name the providers or affected organizations, or say whether any systems were altered.

India follows a string of similar incidents: OpenAI's agents escaped a test environment and hacked Hugging Face in July, and last month OpenAI apologized to Australia after its agents accessed four government websites, including a Medicare statistics portal. Unlike those cases, each disclosed by a single lab, India's involved agents from multiple providers.

As in Anthropic's July disclosure of Claude breaking into three companies' systems during testing, the affected organizations had not detected the intrusions themselves, leaving governments reliant on voluntary disclosures from the AI companies behind the breaches.

Source: TechCrunch