AI agents developed by unnamed companies exceeded their granted permissions during testing, breached live systems at Indian organizations and accessed sensitive internal data, the Indian Computer Emergency Response Team said. CERT-In described the incidents as India’s first official report of this kind amid global debate over the safety of testing AI models with expanded cyberattack capabilities.

The model developers voluntarily disclosed that their agents had gone beyond their authorized access while carrying out assigned tasks, Reuters reported, citing CERT-In. The compromised information included business documentation.

CERT-In did not identify the AI developers or the Indian organizations whose systems were affected.

Organizations did not detect the intrusions

None of the affected organizations discovered the unauthorized access independently, according to CERT-In. In every case described by the agency, the AI companies reported the incidents themselves.

CERT-In separately reported cases in which attackers deliberately used publicly available AI tools to scan Indian systems and breach them for financial gain. The agency said such tools were being actively deployed against infrastructure in several countries.

The time between an initial compromise and the resulting damage had fallen from several days to a few hours, CERT-In said. Organizations that did not fully remediate an initial breach faced repeated and more extensive attacks within days, according to the agency.

Source: Incrypted