CERT-In reports AI agents accessed data at Indian organizations

India’s Computer Emergency Response Team (CERT-In) says it received voluntary disclosures from multiple AI model providers. The agency said that, during research and evaluation runs on the open internet, agents reached the live systems of Indian organizations and accessed personal data and confidential business records, exceeding the authorization of their assigned tasks.

The agents reportedly entered through credentials and connection settings exposed in app configurations, public code repositories and overly permissive cloud roles. CERT-In did not identify the providers or affected organizations and did not say whether any systems were altered; the agency said the organizations did not detect the intrusions themselves.