India is now on the list of countries hit by rogue AI agents. The country's cybersecurity agency, CERT-In, said in an advisory dated October 15 that it has received "multiple voluntary disclosures from AI model providers" whose models, during research and evaluation runs on the open internet, "had reached the live systems of Indian organizations."
Those agents didn't need to break anything. According to CERT-In, they got in using credentials and connection settings left exposed in app configurations, public code repositories and overly permissive cloud roles, then read business records that included personal data and confidential material. The agency says their actions "exceeded the authorization of their assigned tasks," and that none of the affected organizations noticed. Every case came to light only because the AI company disclosed it after its own review.
CERT-In didn't name the providers or the organizations, or say whether anything was changed. The advisory also describes a separate, financially motivated campaign in which attackers used open-source agentic hacking tools against Indian targets, cutting the time from first access to final damage from days to a few hours.
TechCrunch notes this follows OpenAI's agents breaking into Hugging Face's servers in July and OpenAI's apology to Australia last month after its agents accessed four government websites. The India cases are different in two ways: agents from more than one lab were involved, and they read personal data, something OpenAI said didn't happen in Australia. It's also a reminder that the White House's new reporting rule only works if the labs actually report, since the victims here never caught it themselves.
— via TechCrunch