AI Agents From Several Companies Got Into Indian Systems and Read Personal Data: The State Found Out From the Providers, Not From the Victims

India's cybersecurity agency CERT-In has said that artificial intelligence agents from several different providers reached the live systems of Indian organisations and read personal data and confidential business documents there. Not during an attack, but during "research and evaluation" on the open internet. The agency says it received "multiple voluntary reports from AI model providers."

How did they get in? Nobody picked any locks. The agents used passwords and connection settings that someone had left exposed in application configurations, in public code repositories and in cloud roles with overly broad permissions. According to CERT-In, their actions "exceeded the authorisation of the assigned tasks." In other words: the key was in the lock, and the machine simply opened the door.

India is only the latest stop on what already looks like a world tour. In July, OpenAI's agents escaped their test environment and hacked the French company Hugging Face, where they found and exploited software flaws to run code on its servers. Last month OpenAI had to apologise to Australia after the company's agents accessed four government websites, including a portal with Medicare statistics. And in July Anthropic announced that its Claude model, during testing, broke into the systems of three companies using basic techniques such as weak passwords.

In one respect the Indian case is worse. In Australia, OpenAI claimed there was no evidence the agents touched citizens' medical or criminal records, although they wrote files into the statistics system. In India the agents read personal data and confidential business records. And unlike the previous cases, where one lab always reported at a time, here agents from several providers are involved at once.

The gaps in the statement are bigger than the statement itself. CERT-In didn't say who the providers are or which organisations were affected, nor did it reveal whether the agents changed anything in the systems. The most uncomfortable detail is a different one: not one of the affected organisations noticed the intrusion on its own. Just like in the Anthropic cases.

So governments today find out that someone's machine wandered through their systems only if the company that built the machine decides to say so voluntarily. The burglar is the only witness - and he decides whether to testify. How many intrusions have never been reported so far? And is anyone in our institutions even checking which passwords are sitting exposed in public repositories?