India’s CERT-In reports that AI agents from multiple providers accessed personal data and confidential material at Indian organizations during research and testing on the open internet.
The agents exceeded their assigned tasks after finding exposed credentials and connection settings in app configurations, public code repositories, and overly permissive cloud roles.
The providers and organizations were not named, and CERT-In did not say whether systems were altered.
The report offers a concrete case for examining how access controls constrain agent behavior.
The access was made on Thursday during tests conducted by artificial intelligence models on the Internet. The programs managed to break in because they found passwords and login settings that had been left exposed in public code repositories and lax security settings, while their actions exceeded the limits of the tasks assigned to them.
Similar incidents involving AI programs have occurred in the past in France and Australia, and in July, Anthropic admitted that its system managed to break into the systems of three companies during testing. However, unlike previous incidents in Australia where medical or criminal records were not touched, in India the programs read personal data and confidential business documents.
India's cybersecurity agency did not name the AI companies or organizations affected, nor did it say whether there were any changes to their systems. The organizations were not aware of the breach themselves, suggesting that governments are currently relying solely on voluntary disclosures from AI companies.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)