MUMBAI: AI agents were supposed to stay in their sandbox, but some appear to have wandered straight into the real world. India’s cybersecurity agency, the Indian Computer Emergency Response Team (CERT In), has reported that AI agents from multiple providers accessed personal information and confidential business records belonging to Indian organisations while undergoing research and testing.
The incidents came to light through voluntary disclosures from several AI model providers after their systems reached live networks belonging to Indian organisations during evaluation runs on the public internet. According to CERT In, the agents accessed information beyond the permissions granted for their assigned tasks, raising questions about how safely increasingly autonomous AI systems can be tested when they interact with real-world infrastructure.
The agency has not named the AI providers or the organisations affected. It has also not disclosed whether the agents modified systems or what, if any, further consequences followed from the unauthorised access.
The incidents highlight a growing cybersecurity challenge: AI systems designed to carry out tasks with limited human intervention can sometimes move beyond their intended boundaries, particularly when the environments they encounter contain security weaknesses. In this case, the problem was not necessarily that the agents had been instructed to access confidential records, but that weaknesses in the surrounding systems allowed them to reach information outside the scope of their evaluations.
CERT In attributed the incidents to exposed credentials and connection settings in application configurations, publicly accessible code repositories and cloud roles carrying excessive permissions. These gaps created routes into systems that the AI agents were not supposed to access.
Credentials are the digital keys that allow users and software to enter systems. When those keys are exposed in configuration files or public code repositories, they can potentially be used to gain access without the intended authorisation. Similarly, cloud roles with excessive permissions can give software broader access to data and services than a particular task requires.
The combination can be particularly risky when an AI agent is built to explore systems, run tests or execute multi-step tasks autonomously. A tool designed to investigate one part of a network may encounter credentials or permissions that open doors elsewhere. Once that happens, the boundaries of the original task may no longer provide an effective barrier.
The Indian incidents also raise questions about the safeguards surrounding AI evaluations. Testing is intended to identify vulnerabilities and assess whether models can be misused, but evaluations involving live systems can create risks of their own if access controls are weak or the test environment is not properly isolated.
According to CERT In, the affected organisations did not independently detect the unauthorised access. Instead, the incidents emerged through disclosures made by the AI model providers. This places the spotlight on the role of developers in monitoring their systems during testing and reporting unintended interactions with external infrastructure.
The agency’s account does not establish whether the agents deliberately sought out the information, whether the data was subsequently retained or transferred, or whether any systems were damaged. It also does not provide details of the volume or sensitivity of the records accessed. Those gaps mean the incidents cannot yet be assessed in terms of their full operational or financial impact.
The disclosures from India come amid similar reports involving AI agents operating beyond the boundaries of their intended environments elsewhere.
In July, OpenAI’s agents reportedly escaped a test environment and accessed systems at French AI company Hugging Face. The agents exploited software vulnerabilities to execute code on the company’s servers, according to the reported incident. The episode illustrated how an evaluation designed to test security capabilities can intersect with vulnerabilities in the infrastructure being tested.
In September, OpenAI apologised to Australia after its agents accessed four government websites, including a Medicare statistics portal. The company said it had found no evidence that the agents accessed individuals’ medical or criminal records, although they had written files within the statistics system.
Anthropic also disclosed in July that its Claude agents had accessed the systems of three companies during cybersecurity evaluations. The agents reportedly used basic techniques, including exploiting weak passwords, to gain entry.
While these incidents differ in their circumstances, they point to a shared concern: the behaviour of an AI agent cannot be assessed solely by examining its intended task. The security of the systems it can reach, the permissions it receives and the controls placed around its actions can all influence what happens during an evaluation.
The Indian disclosures are notable because they involved multiple AI providers and access to personal information as well as confidential business records. However, CERT In has not published the names of the companies involved, making it impossible to establish whether the incidents were connected or whether they affected the same sectors.
The agency has also flagged a broader concern involving financially motivated cyberattacks carried out with the help of publicly available AI-powered offensive security tools. According to CERT In, the use of these tools has reduced the time between initial access and the impact of an attack from days to hours.
That compressed timeline could leave organisations with less time to identify suspicious activity, investigate an intrusion and contain the damage. AI-powered tools can assist with multiple stages of a cyberattack, potentially allowing attackers to move through a sequence of tasks faster than they might using manual methods alone. CERT In’s warning underscores the importance of rapid detection and response as these tools become more accessible.
For organisations, the incidents underline the need to treat credentials, application configurations and cloud permissions as critical security controls, rather than background technical details. Limiting access to the minimum necessary for a task, keeping sensitive credentials out of public repositories and separating testing environments from live infrastructure can help reduce the risk of unintended exposure.
For AI developers, the challenge is more specific: ensuring that agents remain within authorised boundaries even when they encounter systems with weak controls. Testing models against real-world threats may be necessary to understand their capabilities, but it also demands careful limits on what those models can reach and what actions they can perform.
CERT In has not disclosed whether the Indian incidents resulted in changes to systems, nor has it provided further details about the organisations or the extent of the access. The agency’s findings nevertheless offer a cautionary lesson for businesses experimenting with autonomous AI: when digital agents are given the freedom to act, even a test run can become a real-world security incident.