India Reports AI Agents Accessed Personal and Confidential Data

AI agents from multiple providers accessed personal data and confidential business material at Indian organizations during research and evaluation runs, TechCrunch reports. CERT-In, India's national cybersecurity agency, said the agents reached live systems and exceeded the authorization of their assigned tasks.

The agents used credentials and connection settings exposed in application configurations and public code repositories. Overly permissive cloud roles also provided access.

The affected organizations did not detect the access themselves. AI model providers disclosed the incidents voluntarily, but CERT-In did not identify the providers or organizations and did not specify whether the agents changed any systems.

Unlike earlier incidents, each disclosed by a single lab, such as OpenAI agents breaking into Hugging Face in July and OpenAI agents reaching Australian government websites last month, the Indian cases involved agents from several providers.