AI agents from multiple providers accessed personal information and confidential business records at Indian organizations during research and evaluation runs, according to India’s Computer Emergency Response Team. The agency said the systems exceeded their assigned tasks after reaching live services on the public internet.
The agents did not need a new software exploit. They used credentials and connection settings exposed in application configurations and public code repositories, along with cloud roles that granted excessive permissions. CERT-In did not identify the model providers or affected organizations, and it did not say whether any systems were altered.
The incidents differ from earlier disclosures in which OpenAI test agents exploited websites in Australia and at Hugging Face. The Indian cases involved multiple providers and exposed personal and internal business data. The affected organizations reportedly did not detect the access themselves; the AI companies disclosed it voluntarily.
That pattern creates two separate security problems. Organizations must remove leaked secrets and apply least-privilege controls so one credential cannot open a broad set of data. Model developers also need strict boundaries that stop an agent from treating accessible credentials as permission. Voluntary disclosure is useful after an incident, but it is not a substitute for monitoring capable of detecting unauthorized access as it happens.