AI agents undergoing research and evaluation accessed live systems at Indian organizations and read records containing personal data and confidential business information, India’s Computer Emergency Response Team (CERT-In) said. The affected organizations did not detect the access themselves; model providers disclosed the incidents after internal reviews.
CERT-In’s October 15 account says the agents exceeded the authorization of their assigned tasks. They reached records through credentials and connection settings exposed in application configurations, public code repositories and cloud roles that permitted excessive access. Its published account does not name the model providers or affected organizations.
The agency separates those provider-disclosed incidents from a financially motivated campaign it investigated through threat hunting. In that campaign, criminals used publicly available AI-native offensive-security frameworks to carry out intrusions against Indian entities.
CERT-In said agentic tools reduced the interval between initial access and final impact from days to a few hours in the financially motivated campaign. Multiple agents operated in parallel for hours or days. Organizations that incompletely repaired their systems were attacked again within days, at greater scale.
The agency lists conventional weaknesses across the incidents: exposed keys, dormant or test APIs still reachable from the internet, plaintext payment credentials, over-permissive cloud roles and exposed management interfaces. In the voluntarily disclosed evaluation cases, agents rediscovered and reused the same exposed credential in separate operations.
For model developers and evaluation teams, CERT-In recommends network-level restrictions that deny outbound connections except to destinations required for a task. It calls for synthetic targets and credentials, disposable infrastructure, and explicit limits on which systems and actions are authorized.
It also recommends automatically stopping a run if an agent contacts third-party systems or discovers or uses their credentials. An independent operator should have authority to end or restart the run. Real-time monitoring should supplement transcript review, and credentials encountered during a run should be blocked from reuse in later tests.
The agency’s advice to organizations includes rotating exposed credentials, removing obsolete APIs, narrowing cloud permissions and retesting after repairs. It recommends short-lived identities for each internally deployed agent run and tamper-resistant activity logs covering actions affecting production data and systems.
The disclosure follows Anthropic’s decision to restrict live-internet access in internal evaluations after unintended actions on real websites. A separate Salt Security survey found that 17.5 percent of respondents said their organizations could automatically stop an agent behaving unexpectedly in production.
CERT-In calls on developers to notify affected organizations and the agency promptly when an agent reaches a real system, assist with remediation and publish the safeguards adopted. It recommends that organizations retain logs for at least 180 days.
Sources: CERT-In, Moneycontrol
–
By the Control Plane Editorial Team