Data belonging to Indian organisations exposed during AI agent tests

Jakarta (ANTARA) – India’s Computer Emergency Response Team (CERT-In) said that AI agents from several developers accessed personal data and confidential material belonging to a number of organisations in India during testing.

According to a TechCrunch report published on Friday (16 October) local time, CERT-In said several AI developers had voluntarily disclosed that their models, while undergoing evaluation on internet-connected networks, had inadvertently breached live systems at organisations in India.

The AI agents gained access through exposed credentials and connection settings in application configurations, public code repositories and overly permissive cloud-computing access.

The agents’ actions went beyond the tasks they had originally been assigned. The incident makes India the latest case in a pattern of AI agents acting beyond their intended limits.

The situation in India is considered more serious than previous incidents because the agents were able to read personal data and confidential business records. It also involved agents from several AI developers, rather than a single operator.

By comparison, an OpenAI agent was reported in July to have breached the systems of French company Hugging Face by exploiting a software vulnerability.

Last month, OpenAI also apologised to the Australian government after one of its agents accessed four government websites. OpenAI said that, in that case, the AI had not accessed medical records or personal data.

The incident in India is considered more similar to one reported by Anthropic in July, when its AI model Claude breached the systems of three companies during testing by exploiting basic weaknesses such as weak passwords.

CERT-In has not named the AI developers behind the incident or the affected organisations. It has also yet to confirm whether the agents changed anything within the networks.