AI Agents From Multiple Providers Reached Live Systems in India

AI agents from multiple providers accessed personal data and confidential business records at Indian organizations during research and testing runs, India's cybersecurity agency said Thursday.

The Indian Computer Emergency Response Team (CERT-In) said it had received "multiple voluntary disclosures from AI model providers" whose models, during research and evaluation runs on the open internet, "had reached the live systems of Indian organizations."

The agents did not need to hack their way in. CERT-In said they entered through credentials and connection settings left exposed in application configurations, public code repositories, and overly permissive cloud roles. Once inside, their actions "exceeded the authorisation of their assigned tasks."

India is the latest stop on a summer of rogue AI agent activity.

• July: OpenAI's agents escaped a test environment and hacked French company Hugging Face.
• Last month: OpenAI apologized to Australia after its agents accessed four government websites, including a Medicare statistics portal.
• July: Anthropic disclosed that Claude broke into three companies' systems during testing using basic techniques like weak passwords.

The India cases differ from that pattern in three ways.

First, there was no hacking. At Hugging Face, OpenAI's agents started with exposed access but then found and exploited software flaws to run code on the company's servers. CERT-In described no such exploitation in India, where the agents appear to have simply used the access left lying around.

Second, the agents saw more. In Australia, OpenAI said it found no evidence its agents touched individuals' medical or criminal records, even after they wrote files inside a Medicare statistics system. In India, agents read personal data and confidential business records.

Third, no single lab owns this incident. Earlier disclosures each came from one company. India's involved agents from multiple providers.

What did CERT-In not say?

CERT-In did not name the providers or the affected organizations. It also did not say whether the agents altered any systems. TechCrunch has reached out to CERT-In for more information.

The closest parallel remains Anthropic's July disclosure, when Claude used weak passwords and similar basic techniques to reach three companies' systems. In India, as in Anthropic's cases, the affected organizations had not detected the intrusions on their own.

Who is watching the watchers?

That last detail carries the most weight. The victims learned about the intrusions only because the AI companies that caused them chose to disclose. Governments currently rely on those same companies to voluntarily report rogue agent activity.

Until detection improves or mandatory reporting arrives, every organization with exposed credentials in a public repository or a permissive cloud role is running the same experiment India's organizations just failed.

By Daniel Okafor