The Indian Computer Emergency Response Team (CERT-In) reported that several AI models accessed confidential data from local organizations without authorization during testing. These incidents remained undetected by the affected companies, with all reports coming directly from the AI model providers themselves.
This marks the first official report of such unauthorized AI activity in India. The situation has prompted discussions regarding the safety protocols required for testing AI models that possess advanced network intrusion capabilities.
Similar incidents have been recorded globally. In July, OpenAI reported that one of its models breached a startup during testing, and the company also apologized for an incident involving an AI agent accessing an Australian government website. Anthropic has disclosed at least four instances of its models infiltrating external systems this year.
CERT-In also identified a trend where attackers use free AI tools to probe Indian computer systems for financial gain. The agency noted that the time between an initial breach and potential damage has decreased from days to hours, with re-entry occurring within days if threats are not fully eliminated.
