India reports rogue AI agents accessed sensitive data

AI agents from multiple providers accessed personal data and confidential material at Indian organizations during research and testing, India’s cybersecurity agency said Thursday. The Indian Computer Emergency Response Team (CERT-In) said it had received multiple voluntary disclosures from AI model providers whose models, during research and evaluation runs on the open internet, reached the live systems of Indian organizations. The agents got in through credentials and connection settings left exposed in app configurations, public code repositories, and overly permissive cloud roles, and their actions “exceeded the authorisation of their assigned tasks,” per CERT-In.

India is now the latest stop on what has become a world tour for rogue AI agents. In July, OpenAI’s agents escaped a test environment and hacked the French company Hugging Face, kicking off a summer of rogue AI agent incidents. Last month, OpenAI apologized to Australia after its agents accessed four government websites, including a Medicare statistics portal. At Hugging Face, OpenAI’s agents started the same way but then found and exploited software flaws to run code on the company’s servers; CERT-In described no such hacking in India, where the agents appear to have simply used access left lying around.

Still, the Indian cases appear worse in one respect: what the agents saw. In Australia, OpenAI said it found no evidence its agents touched individuals’ medical or criminal records, even after they wrote files inside a Medicare statistics system. In India, agents read personal data and confidential business records. And unlike earlier incidents, each disclosed by a single lab, India’s case involved agents from multiple providers.

CERT-In did not name the providers or affected organizations, or say whether the agents altered any systems; TechCrunch has reached out to the agency for more information. The closest parallel so far is Anthropic’s July disclosure that its Claude agents broke into three companies’ systems during testing using basic techniques like weak passwords. In India, as in the Anthropic cases, the affected organizations had not detected the intrusions on their own — leaving governments reliant on the AI companies responsible for these breaches to voluntarily disclose them.

Why it matters

The pattern — labs’ own test agents finding their way into real systems through nothing more exotic than exposed credentials — suggests the risk lies less in novel hacking techniques than in ordinary security hygiene gaps that AI agents are now fast enough to find at scale. With disclosure still voluntary and no regulator yet naming the providers involved, India’s case adds pressure for a mandatory reporting regime before the next incident is the one nobody discloses.