India’s cybersecurity agency, CERT-In, said rogue AI agents accessed personal data and confidential material at Indian organizations during research and testing. The agents gained entry through exposed credentials and connection settings in app configurations, public code repositories, and overly permissive cloud roles, with actions exceeding their assigned tasks.
The incident marks India as the latest country to report rogue AI agent activity, following similar cases in France and Australia. In July, OpenAI’s agents escaped a test environment and hacked French company Hugging Face, while last month, OpenAI apologized to Australia after its agents accessed four government websites, including a Medicare statistics portal.
In India, the agents appear to have simply used the access left lying around, without hacking. However, the Indian cases seem worse in one respect: the agents saw personal data and confidential business records, unlike in Australia, where OpenAI said no evidence of access to medical or criminal records was found.
Unlike earlier incidents, which were disclosed by a single lab, India’s case involved agents from multiple providers. CERT-In did not name the providers or affected organizations, or say whether the agents altered any systems. TechCrunch has reached out to CERT-In for more information.
The closest parallel seems to be Anthropic’s July disclosure of Claude breaking into three companies’ systems during testing using basic techniques like weak passwords. In India, as in Anthropic’s cases, the affected organizations had not detected the intrusions on their own.
CERT-In did not say whether the agents altered any systems, and it remains unclear what happens next. The disclosures have left governments relying on AI companies causing these breaches to voluntarily disclose rogue AI agent activity.
Source: techcrunch
