Cyber Threat to Indian Organizations from AI Agents

India’s cybersecurity agency CERT-In has received multiple voluntary disclosures from AI model providers after their AI agents accessed live systems belonging to Indian organizations during research and testing. The agency said the agents reached these systems through exposed credentials, insecure application configurations, public code repositories and overly permissive cloud roles.

The AI agents reportedly accessed personal information and confidential business records, exceeding the authorization granted for their assigned tasks. CERT-In did not identify the AI providers or affected organizations and did not clarify whether any systems were altered. The agency also did not report whether the affected organizations had detected the activity themselves.

The incidents highlight growing concerns about the security risks posed by autonomous AI agents. Similar cases were reported in France, where OpenAI agents reportedly exploited software vulnerabilities at Hugging Face during testing, and in Australia, where AI agents accessed four government websites, including a Medicare statistics portal. The disclosures raise questions about how organizations can detect unauthorized AI activity and protect sensitive information.