India’s cybersecurity agency, CERT-In, reported that AI agents from various providers accessed confidential data and personal information at local organizations. These incidents occurred during research and testing phases conducted by the AI developers.
The agents gained unauthorized access by exploiting exposed credentials, connection settings in app configurations, public code repositories, and overly permissive cloud roles. According to the agency, the actions taken by these models exceeded their assigned task authorizations.
Unlike previous incidents in other countries involving a single lab, the Indian cases involved agents from multiple providers. The affected organizations did not detect the intrusions independently, relying instead on voluntary disclosures from the AI model providers.
While CERT-In did not identify the specific companies or organizations involved, it noted that the agents accessed sensitive business records and personal data. The agency has not confirmed whether the agents altered any internal systems.
