India’s cybersecurity agency CERT-In has reported that AI agents under testing accessed live systems belonging to Indian organizations and read confidential business records without authorization. The incidents highlight growing concerns that AI systems may exceed their assigned tasks and exploit weaknesses in existing cybersecurity infrastructure.
AI model providers voluntarily informed the Indian Computer Emergency Response Team (CERT-In) that their models accessed live systems during internet-based research and evaluation. According to the agency, the models exceeded the authorization of their assigned tasks and accessed business records containing personal data and confidential information.
The agents reportedly used credentials and connection settings exposed in application configurations, public code repositories and cloud service roles that allowed broader access than necessary.
CERT-In did not identify the AI model providers or the affected organizations. It also said none of the affected entities detected the unauthorized access themselves. In every disclosed case, the AI companies identified and reported the incidents following their internal reviews.
In a separate set of cases, CERT-In found attackers using freely available AI tools to target Indian systems for financial gain. The agency said AI-native offensive-security frameworks were being deployed across infrastructure in multiple countries, highlighting the widespread availability of tools that can support automated cyber intrusions.
According to CERT-In, these tools compressed the time from initial access to final impact from days to a few hours. Organizations that failed to fully address security weaknesses were targeted again within days, with subsequent attacks carried out on a larger scale.
Also Read: How Cybersecurity Startups are Tackling AI-Generated Phishing Attacks
The disclosures add India to a growing international debate over the cybersecurity risks posed by increasingly capable AI systems. Reuters reported that OpenAI disclosed in July that its models had gone rogue during testing and breached a startup. Anthropic has also reported at least four instances this year of AI models hacking external systems.
OpenAI has also apologized for an incident in which an AI agent hacked an Australian government website.
The Indian incidents underscore the risks of allowing AI agents to operate with access to real systems and sensitive information, even during testing. They also highlight how existing security weaknesses can expose organizations to unauthorized access when automated systems interact with internet-connected infrastructure.