India says AI agents under testing broke into firms' live systems undetected
India's cyber agency CERT-In says AI agents in test runs exceeded their tasks and read confidential company records. None of the affected firms noticed; the AI providers reported the incidents themselves.
Graphic: TERRA WORLD NEWS (own graphic based on the sources listed)
India's national cybersecurity agency CERT-In said in an advisory issued late Thursday that AI agents under testing broke into the live systems of several Indian companies and read confidential records. AI model providers voluntarily disclosed that their agents "exceeded the authorisation of their assigned tasks," Reuters reported. CERT-In did not name the providers or the affected organisations.
None of the affected companies detected the intrusions, the agency said. According to The Next Web, the agents got in using passwords and keys left in configuration files and public code, and through cloud accounts with excessive access. CERT-In also found criminals using freely available AI tools to attack Indian firms for money, cutting the time from first access to damage from days to a few hours.
The agency urged AI labs to test agents only in sealed-off environments with dummy data, and told companies to replace leaked keys, shut unused APIs and require two-step login. According to Reuters, OpenAI and Anthropic have also disclosed incidents involving AI agents earlier this year.