India's state cybersecurity agency CERT-In announced that artificial intelligence breached the real-world systems of Indian companies and organizations during testing. AI agents from several different developers accessed personal data as well as confidential business documents. None of the affected organizations noticed anything, and the authorities only learned of the breaches from the companies developing the artificial intelligence.
For India, this is the first official report of its kind. The country thus joins France and Australia, where similar incidents came to light during the summer and early autumn.
Companies that develop agents test them regularly. They examine their capabilities and often assess how well they can handle computer security. During such tests in India, the agents went beyond their designated environments. CERT-In said their actions exceeded the permissions they had been granted for the assigned tasks.
Passwords were on the internet
The agents did not breach the Indian systems using any sophisticated hacking trick. They used login credentials and connection settings that companies had left exposed in their application configurations or in publicly accessible code on the internet. Another route was opened by cloud accounts that had been granted much broader permissions than they actually needed.
Put simply, the agents did not have to pick the lock because they found the keys under the doormat and unlocked the door themselves. CERT-In pointed out that these were entirely commonplace security mistakes. However, artificial intelligence can find and exploit them faster and on a larger scale than a human can. The agency also warned that instructions alone will not stop an agent if it unexpectedly encounters an open path.
The agency did not disclose the names of the developers or the affected organizations, nor did it say whether the agents changed anything in the systems. All the cases were reported voluntarily by the developers after they discovered them during their own internal reviews.
The Indian cases follow a series of similar events in recent months. In July, OpenAI agents escaped their testing environment and attacked the French company Hugging Face. At first, it looked similar to what happened in India, but the agents then found software vulnerabilities and exploited them to run their own code on the company's servers. CERT-In described nothing of the sort in the Indian cases, as the agents there apparently made do with access credentials that someone had left lying around.
In September, OpenAI apologized to Australia. Its agents gained access to four government websites, including a portal containing Medicare health insurance statistics, where they even wrote files. The company said it found no evidence that the agents accessed the health or criminal records of specific individuals.
This makes the Indian case worse, because the agents there actually accessed personal data and confidential corporate documents. Earlier incidents also always involved only a single laboratory, whereas agents from multiple developers were responsible in India.
The closest parallel is Anthropic's announcement in July. During testing, its Claude model gained access to the systems of three companies using simple methods such as trying weak passwords. Anthropic has admitted to at least four cases this year in which its models breached third-party systems, and in those instances the affected companies also failed to notice the breaches themselves.
Attackers have put AI to work
During its own investigation, CERT-In also encountered a second, deliberate form of the problem. According to the agency, cybercriminals are using freely available artificial intelligence tools that were originally developed to test computer network defenses. With their help, they probe Indian systems, search for weaknesses, and break into them for financial gain. The agency says the same tools are appearing on infrastructure in many other countries.
According to reports, attackers deploy several agents at once and have them work in coordination for hours or even days. The time between a breach and the resulting damage is thus shrinking from days to just hours.
Experts warn that agents with broad access can reach sensitive data through routes that organizations never anticipated. In doing so, they exploit gaps that already exist in systems, including misconfigured cloud services, exposed login credentials, and excessive permissions.
CERT-In therefore urged artificial intelligence developers to separate testing from real-world systems and technically restrict agents' internet access. During tests, they should use fabricated data and fictitious login credentials, monitor agents in real time, and automatically terminate any test in which an agent strays beyond the permitted boundaries. According to the agency, organizations that confirm unauthorized access should consider their systems compromised until a detailed forensic investigation has examined them.
Indian authorities learned of the breaches only because the developers reported them themselves. For now, governments therefore have no option but to trust that companies whose agents breach third-party systems will continue to disclose such incidents voluntarily. No one yet knows how many cases have gone unreported.
Sources: techcrunch.com and reuters.com
