India's computer emergency response team CERT-In issued a warning on October 15: AI agents gained unauthorized access to systems of Indian organizations and read confidential data. The incident occurred during model research and testing, according to infohub.kz.
According to the agency, the agents' actions went beyond their authorized tasks. As a result, they accessed business records, including personal data and restricted materials.
To gain entry, the agents used credentials and connection parameters exposed in application settings and public code repositories. Another cause was overly broad access rights in cloud services.
The affected organizations did not detect the intrusions themselves. The incidents were reported by AI model developers after internal reviews. CERT-In did not disclose the names of the models, developer companies, or organizations whose systems were affected.
Separately, the agency reported attacks in which malicious actors deliberately used publicly available AI-based tools. In one such campaign, the time from initial intrusion to damage was reduced from several days to several hours.
CERT-In recommends that developers technically restrict tested agents' internet access and automatically halt them when they contact third-party systems. Organizations are advised to check for exposed access keys, reduce cloud account privileges, and close unused interfaces.