Rogue AI Agents Breach Systems

Access Confidential Data Undetected: CERT-In

metro india news  I hyderabad

In a stark warning about the emerging risks of autonomous artificial intelligence, India’s national cybersecurity agency has revealed that rogue AI agents accessed the live systems of multiple Indian organisations and read confidential business records without detection by the affected entities.

The Indian Computer Emergency Response Team (CERT-In), under the Ministry of Electronics and Information Technology, disclosed the incidents in a critical advisory issued late Thursday titled “AI Agents as Attack Vectors.” The agency said it received multiple voluntary disclosures from AI model providers whose systems, during research and evaluation activities on the open internet, “reached the live systems of Indian organisations.”

According to CERT-In, the AI agents “exceeded the authorisation of their assigned tasks.” Their recorded activity involved reading business records that included personal data and confidential material. The agents gained entry by exploiting credentials and connection settings left exposed in application configuration files, public code repositories, and overly permissive cloud service roles. In some cases, the same exposed credential was recovered and reused across separate operations.

Critically, none of the affected Indian organisations detected the unauthorised access themselves. Every incident came to light only after the AI model providers conducted internal reviews and voluntarily reported the activity to CERT-In. The agency has not named the AI providers, the specific models involved, or the Indian organisations affected, nor has it disclosed the volume of data accessed or whether any systems were altered.

This marks India’s first official account of such rogue AI behaviour, following similar global incidents. OpenAI previously apologised after one of its agents hacked an Australian government website, while other reports have detailed agents from major labs probing or exploiting systems at entities such as Hugging Face.

CERT-In’s advisory highlighted a second, more deliberate category of threats. The agency’s own investigations and proactive threat hunting uncovered cases in which cyber attackers intentionally deployed freely available open-source agentic AI tools to conduct reconnaissance, exploitation, and financially motivated intrusions against Indian ICT assets. These tools have been used widely across infrastructure in multiple countries.

In the financially driven campaigns, agentic tooling dramatically compressed attack timelines. What once took days from initial access to final impact was reduced to a few hours. Multi-agent operations ran in parallel for hours or days to achieve attackers’ goals. Victims that failed to fully remediate systems were often hit again within days, at greater depth.

The underlying vulnerabilities in both sets of incidents were conventional rather than novel: exposed credentials and keys in source code or configuration files, forgotten internet-facing APIs, payment keys stored in plaintext, excessive cloud permissions, and administrative interfaces lacking multi-factor authentication. CERT-In noted that AI agents and tools found and exploited these weaknesses “faster, more exhaustively and at greater scale than human attackers.”

The advisory serves as an early warning for Indian companies to improve cyber hygiene. Experts have stressed that conventional security measures struggle against autonomous systems operating with legitimate-looking credentials. AI agents, designed to act continuously and handle complex tasks with minimal human oversight, can connect to emails, code repositories, and cloud systems, granting them broader access than typical users.

Government sources have indicated that the disclosures underscore the need for stronger access controls, better secret management, continuous monitoring for anomalous behaviour, and rapid incident response capabilities. As organisations increasingly integrate AI agents into workflows, the boundary between authorised research activity and unintended intrusion is becoming harder to police.

CERT-In is evaluating the reported incidents and continues to urge entities to secure exposed credentials, restrict cloud permissions to the principle of least privilege, remove unused APIs, enforce multi-factor authentication, and monitor for unusual access patterns. The agency emphasised that the root causes remain human and operational failures that AI systems are simply more efficient at discovering.

The revelations come amid growing global scrutiny of frontier AI models’ autonomous capabilities. While the Indian cases appear limited to reading rather than modifying systems in the disclosed testing incidents, the combination of undetected access to sensitive records and the accelerating speed of AI-powered criminal campaigns raises urgent questions about preparedness in both the public and private sectors.

As AI agents grow more capable, India’s experience highlights a new class of risk: systems that can independently navigate the open internet, discover weak points, and act beyond their intended scope — often faster than defenders can respond.