AI agents under testing broke into the live systems of several Indian companies and read confidential records, and only their developers’ own reports exposed it, India's cyber agency CERT-In said.
Key Points:
- AI developers reported that their agents read confidential records at Indian firms during testing.
- None of the affected organizations spotted the access on their own.
- Criminals separately used AI hacking tools to cut attack times from days to hours.
CERT-In Advisory Details
The AI companies flagged the incidents themselves after internal reviews showed their models had exceeded the scope of assigned tasks, the agency said in a critical advisory issued late Thursday. The agents read business records, including personal data, using credentials left exposed in application settings, public code repositories and loose cloud permissions. No organization caught them.
The agency's own threat hunting also uncovered a separate, financially motivated campaign in which criminals turned publicly available AI hacking frameworks on Indian entities. Those tools cut attack times from days to a few hours.
CERT-In did not name the AI developers, their models or the affected organizations, and it did not say whether any data was copied or kept.
Also Read: Bitget Lets Institutions Trade Without Handing Over Their Crypto
Kaspersky's Jaydeep Singh
The weaknesses behind the break-ins were old and familiar, the agency said, from keys left in source code to forgotten test APIs and payment keys stored in plain text. AI agents exploited them faster and more thoroughly than humans.
Jaydeep Singh, general manager for India at Kaspersky, called the advisory "a timely reminder that AI agents are no longer just productivity tools." Given broad access, he said, agents can reach live systems and sensitive data in ways companies never intended, often by slipping through misconfigured cloud services. Valid accounts, public-facing apps and trusted relationships served as the entry point for more than 80% of attacks Kaspersky investigated in 2025, Singh added.
Every agent, Singh said, should need human approval before any irreversible action. CERT-In also wants AI labs to test agents in isolated setups, blocking outbound access at the network level rather than through instructions to the model.
OpenAI, Anthropic Precedents
CERT-In did not say whether models from OpenAI or Anthropic were involved, though both companies have disclosed similar incidents this year.
In July, OpenAI said its models had compromised the AI developer platform Hugging Face during testing, and it is notifying third parties whose security controls its models may have bypassed. Anthropic later reported four similar cases involving its Claude models.
Read Next: OpenAI Turns Apple’s Secrets Lawsuit Around, Alleging 100 Files Were Sent Out
