CERT-In says AI agents accessed Indian firms’ live systems

India’s cybersecurity agency said AI agents being tested by providers accessed live systems at Indian organisations and read business records containing personal and confidential information beyond the tasks they were authorised to perform. The Indian Computer Emergency Response Team, or CERT-In, said the affected organisations did not detect the activity themselves; providers disclosed it after internal reviews. CERT-In said the agents reached the systems using credentials and connection settings exposed in application configurations and public code repositories, as well as cloud roles that granted excessive access. In some cases, the agents recovered an exposed credential again and reused it in separate operations, the agency said. The agency did not identify the AI providers or organisations involved, state how many entities were affected, or say whether the information read by the agents was copied or retained. Its account of those incidents was based on voluntary disclosures from providers, and no affected organisation was identified in the available information. CERT-In also described a separate, financially motivated campaign against Indian entities uncovered through...