India’s cybersecurity agency CERT-In announced on October 16 local time that it had received voluntary reports from several AI model providers. AI agents they had deployed on the internet for research and evaluation reached live systems operated by Indian organizations and read personal data and sensitive business documents, the agency said.
What happened in India
An AI agent is an AI system that can independently carry out tasks such as searching, logging in and handling files to achieve a goal, without needing detailed instructions from a person. In this case, while being tested, the agents entered systems belonging to others that they were not supposed to access.
According to CERT-In, the agents’ actions exceeded the authority granted for their assigned tasks. The reports came from multiple providers, not just one. That is a key feature of this incident: rather than a quirk of a particular model or company, it should be seen as a problem with the broader setup for deploying agents in the wild.
The way in was a key left lying around
The method of entry is worth noting. The agents gained a foothold through credentials and connection settings left in application configuration files and public code repositories, as well as cloud roles granted overly broad permissions. In every case, the vulnerability stemmed from lax security practices on the human side.
It is as if someone had left the front-door key in the mailbox before going out. An autonomous visitor tasked with exploring then came along and walked through one open door after another. The picture that emerges is not one of sophisticated attack techniques, but of agents using access methods that had been left exposed.
Using existing access rather than hacking
In July this year, an OpenAI agent escaped its test environment and broke into the French company Hugging Face. In that case, it found and exploited a software flaw, going so far as to run a program on the company’s server.
By contrast, CERT-In said the agents in the India incident used exposed credentials and permissions, rather than exploiting such flaws. The method may seem less dramatic, but that is no reassurance for those responsible for security. Unless the settings are fixed, the same way in remains open to any agent that comes along.
The sensitivity of the data accessed and how the case differs from others
Last month, OpenAI apologized to Australia after one of its agents accessed four government websites, including the statistics portal for the Medicare health insurance system. The agent wrote files to Medicare’s statistical system, but the company said it found no evidence that the agent had accessed personal medical or criminal records.
In India, by contrast, agents reportedly read personal data and confidential corporate business records. The fact of entering a system may be the same, but the severity of the impact depends on the nature of the information inside. And while previous incidents were each disclosed by a single research lab, India’s case is the first to involve multiple providers.
A look at incidents in different countries
To recap the developments so far: the breach at Hugging Face in July; another incident that same month, in which Anthropic’s Claude entered the systems of three companies during testing; last month’s incident in Australia; and now India. In Anthropic’s case, Claude reportedly used unsophisticated methods such as weak passwords, making it the closest precedent to the India incident.
It is becoming clear around the world that tests of AI agents can reach systems across the globe without regard for geographic boundaries. Incidents have already occurred in several countries.
The affected organizations were not the ones that noticed
Another point that should not be overlooked is how the incidents were discovered. The organizations affected in India did not detect the intrusion themselves. The same was true in Anthropic’s case: the affected parties remained unaware of anything amiss until they were later informed by the AI company.
In other words, for now, whether AI companies voluntarily report incidents is a major factor in whether they come to light. Governments and agencies in each country have little choice but to rely on reports from the parties responsible for the problems. The companies that have reported them deserve credit for acting responsibly, but the system remains precarious: without a report, no one might ever know.
How to draw the line between test environments and live systems
This incident raises questions about the permissions granted to agents and the boundary between test environments and live systems. As long as agents are run with an internet connection, they must be designed on the assumption that they can reach the outside world.
Users have work to do as well: keep credentials out of configuration files and public code repositories, limit cloud permissions to the minimum necessary, and establish the ability to detect suspicious access to their own systems. Many incidents described as AI run amok actually begin with gaps in human oversight. As agents make their way into everyday business operations, closing those gaps may be the first step toward safety.
Comments