India Reports First-Ever Rogue AI Agent Activity

India’s cybersecurity authority reported Thursday that AI agents from various providers accessed personal information and confidential materials at Indian organizations during research and testing phases.
The Indian Computer Emergency Response Team (CERT-In) stated it received “multiple voluntary disclosures from AI model providers” whose models, during research and evaluation runs on the open internet, “had reached the live systems of Indian organizations.”
The agents gained access through credentials and connection settings left exposed in app configurations, public code repositories, and overly permissive cloud roles, with their actions “exceeding the authorization of their assigned tasks.”
This marks India as the latest destination in what has become a global tour for rogue AI agents. In July, OpenAI’s agents escaped a test environment and hacked French company Hugging Face, kicking off a summer of rogue AI agent activity. Last month, OpenAI apologized to Australia after its agents accessed four government websites, including a Medicare statistics portal.
At Hugging Face, OpenAI’s agents started in the same way but then found and exploited software flaws to run code on the company’s servers. CERT-In described no such hacking in India, where the agents appear to have simply used the access left lying around.
However, the Indian cases appear more severe in one respect: what the agents saw. In Australia, OpenAI stated it found no evidence its agents touched individuals’ medical or criminal records, even after they wrote files inside a Medicare statistics system, while in India, agents read personal data and confidential business records. Unlike earlier incidents, each disclosed by a single lab, India’s involved agents from multiple providers.
CERT-In did not name the providers or affected organizations, nor did it state whether the agents altered any systems. TechCrunch has reached out to CERT-In for more information.
For now, the closest parallel seems to be Anthropic’s July disclosure of Claude breaking into three companies’ systems during testing using basic techniques like weak passwords.
In India, as in Anthropic’s cases, the affected organizations had not detected the intrusions on their own. The disclosures have left governments relying on AI companies causing these breaches to voluntarily disclose rogue AI agent activity.
Related article
Amazon Taps AI and Clean Energy to Power Data Centre Expansion
Amazon leverages AI, nuclear power, and electric vehicles to scale infrastructure while reducing carbon intensity. Credit: AmazonAmazon’s 2025 Sustainability Report details how the tech giant integrates AI and nuclear investments to expand global inf
Anthropic adjusts Claude pricing for India, its largest market after the US
Anthropic has begun adjusting Claude’s pricing for India, its largest market outside the U.S., as global AI firms increasingly customize offerings to capture users in the world’s most populous country.Localized pricing is now visible for some Indian
Avataar’s Video AI Tackles India’s Scale With Speed, Savings, and Cultural Nuance
India’s AI model output has been slow compared to the U.S., Europe, and China. Only a few startups are releasing models, and most of them are large language models or voice models. To encourage more development, the government launched the India AI M
Related Special Topic Recommendations
Comments (0)
0/500

India’s cybersecurity authority reported Thursday that AI agents from various providers accessed personal information and confidential materials at Indian organizations during research and testing phases.
The Indian Computer Emergency Response Team (CERT-In) stated it received “multiple voluntary disclosures from AI model providers” whose models, during research and evaluation runs on the open internet, “had reached the live systems of Indian organizations.”
The agents gained access through credentials and connection settings left exposed in app configurations, public code repositories, and overly permissive cloud roles, with their actions “exceeding the authorization of their assigned tasks.”
This marks India as the latest destination in what has become a global tour for rogue AI agents. In July, OpenAI’s agents escaped a test environment and hacked French company Hugging Face, kicking off a summer of rogue AI agent activity. Last month, OpenAI apologized to Australia after its agents accessed four government websites, including a Medicare statistics portal.
At Hugging Face, OpenAI’s agents started in the same way but then found and exploited software flaws to run code on the company’s servers. CERT-In described no such hacking in India, where the agents appear to have simply used the access left lying around.
However, the Indian cases appear more severe in one respect: what the agents saw. In Australia, OpenAI stated it found no evidence its agents touched individuals’ medical or criminal records, even after they wrote files inside a Medicare statistics system, while in India, agents read personal data and confidential business records. Unlike earlier incidents, each disclosed by a single lab, India’s involved agents from multiple providers.
CERT-In did not name the providers or affected organizations, nor did it state whether the agents altered any systems. TechCrunch has reached out to CERT-In for more information.
For now, the closest parallel seems to be Anthropic’s July disclosure of Claude breaking into three companies’ systems during testing using basic techniques like weak passwords.
In India, as in Anthropic’s cases, the affected organizations had not detected the intrusions on their own. The disclosures have left governments relying on AI companies causing these breaches to voluntarily disclose rogue AI agent activity.
Amazon Taps AI and Clean Energy to Power Data Centre Expansion
Amazon leverages AI, nuclear power, and electric vehicles to scale infrastructure while reducing carbon intensity. Credit: AmazonAmazon’s 2025 Sustainability Report details how the tech giant integrates AI and nuclear investments to expand global inf
Anthropic adjusts Claude pricing for India, its largest market after the US
Anthropic has begun adjusting Claude’s pricing for India, its largest market outside the U.S., as global AI firms increasingly customize offerings to capture users in the world’s most populous country.Localized pricing is now visible for some Indian
Avataar’s Video AI Tackles India’s Scale With Speed, Savings, and Cultural Nuance
India’s AI model output has been slow compared to the U.S., Europe, and China. Only a few startups are releasing models, and most of them are large language models or voice models. To encourage more development, the government launched the India AI M





Home






