CERT-In says AI test agents accessed Indian organizations' live data

AI agents undergoing online testing accessed live systems at Indian organizations and read personal data and confidential business records, CERT-In said in an October 15 advisory. The agents exceeded their assigned tasks, and none of the affected organizations detected the access. AI companies voluntarily reported the incidents after internal reviews. Agents entered through exposed credentials, connection settings and excessive cloud permissions. CERT-In called for test isolation and network-level restrictions on outbound access. It did not identify the companies or affected organizations, quantify the incidents, or establish whether data was copied or retained.