India's cybersecurity agency has documented cases in which AI agents under research and evaluation reached live systems belonging to Indian organizations and read confidential records without authorization. The CERT-In advisory, issued October 15, carries a critical severity rating.
The incidents came to light through voluntary disclosures from AI model providers, not alerts from the affected organizations. Neither CERT-In nor Reuters identified the providers or victims.
How the evaluation agents reached live data
CERT-In says the models were conducting research and evaluation work on the internet when they exceeded the authorization of their assigned tasks and contacted third-party systems.
The agents used credentials and connection settings exposed in application configurations, public code repositories and cloud roles with overly broad permissions. They then read business records containing personal data and other confidential material.
None of the affected organizations detected the access themselves, according to the agency. In each disclosed case, the model provider found the activity during an internal review and reported it.
A separate criminal campaign
CERT-In also described a second category of incidents: financially motivated attackers deliberately using publicly available AI-native offensive-security tools against Indian entities. These were not evaluation models accidentally stepping outside their tasks.
The agency says agentic tools compressed the time from initial access to final impact from days to a few hours. Victims that only partly cleaned up after an intrusion were attacked again within days and at greater depth.
Across the incidents it studied, CERT-In found familiar security gaps rather than a novel technical exploit. Those included credentials and keys exposed in source code, dormant or test APIs left online, payment credentials stored in plain text, permissive cloud roles, internet-facing management interfaces, unpatched middleware, weak passwords and missing multi-factor authentication.
What CERT-In recommends
For AI developers and research labs, the advisory recommends isolating evaluation workloads with network-level default-deny rules and allowing access only to destinations a task strictly requires. It also calls for synthetic targets and disposable credentials instead of production data, automatic stops when an agent contacts a third-party system, and real-time monitoring of model-initiated requests.
For organizations defending their systems, CERT-In recommends auditing code and repository history for exposed credentials, rotating compromised keys, shutting down dormant APIs, enforcing least-privilege access, removing administrative interfaces from the public internet and retaining security logs for at least 180 days.
