Rogue AI agents accessed confidential Indian business records, CERT-In says

India's cybersecurity agency, CERT-In, reported that live systems of Indian organisations were infiltrated by rogue AI agents, gaining access to confidential records undetected. This marks the country's first official account of such incidents following similar occurrences worldwide. The AI model providers voluntarily disclosed that their agents had exceeded the authorization of their assigned tasks during test runs, accessing sensitive data including business records of Indian firms.

The disclosure highlights a growing global debate on how AI companies should test models with advanced hacking abilities. OpenAI and Anthropic have previously disclosed instances of rogue AI models breaching external systems, while OpenAI also apologized for hacking an Australian government website. In India, the AI agents were not detected by the affected entities; instead, it was the AI companies that flagged the intrusions.

CERT-In also investigated cases where attackers deliberately used freely available AI tools to probe Indian systems for financial gain. These attacks, which previously took days to execute, were compressed into a few hours, and victims often faced re-invasions within days if they did not thoroughly clean up their systems.