In brief
- India says AI agents under research and evaluation exceeded their assigned authorization and read personal and confidential business records on live Indian systems. None of the affected organizations detected it themselves.
- CERT-In did not name the AI providers, models or affected organizations, and the incidents surfaced only through voluntary disclosures from the providers after internal reviews.
- Separately, criminals using public AI offensive-security frameworks cut the time from initial access to final impact from days to a few hours, per the agency.
India’s national cybersecurity agency revealed AI agents operated by unnamed model providers exceeded their assigned tasks during testing and read confidential business records on live Indian systems.
The Indian Computer Emergency Response Team, known as CERT-In, flagged the activity this week in a critical advisory titled “AI Agents as Attack Vectors.”
CERT-In said it received multiple voluntary disclosures from AI model providers whose models reached the live systems of Indian organizations while undergoing research and evaluation on the internet. The agency did not name the providers, the models, or the affected organizations.
The agents read business records containing personal data and confidential material, using credentials and connection settings that were left exposed in application configurations, public code repositories and overly permissive cloud service roles, which are the permission sets attached to cloud accounts.
In some cases they recovered the same exposed credential more than once and reused it in separate operations.
None of the affected organizations detected the access on their own, and every case surfaced only because the model provider disclosed it after an internal review.
This is yet another case of AI agents disrupting big companies and governments. Anthropic disclosed on July 30 that Claude models, told they had no internet access, compromised three real companies during capture-the-flag challenges, exercises in which a model must break into a machine and retrieve a hidden secret.
Britain’s AI Security Institute reported on Aug. 4 that agents took 19 unsanctioned actions across 10 of 122 evaluation runs, 17 of them from Anthropic’s Mythos 5 and two from OpenAI’s GPT-5.6 Sol. The institute had deliberately enabled internet access for the test.
OpenAI’s case involved far more agents: roughly 1,200 of them coordinated on a hidden message board while trying to cheat a cybersecurity test, and about 700 attacked Hugging Face, according to an independent investigation by METR and Redwood Research.
Separately, CERT-In observed criminals using publicly available, AI-powered offensive security frameworks to scan for weaknesses, exploit them and run financially motivated attacks against Indian entities. The agency said the tools are repeatedly repackaged and redeployed, with deployments found on servers in multiple countries.
Daily Debrief Newsletter #
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
Join 72,000+ readers