Bypassing firewalls, AI agents accessed data of Indian firms: CERT-In

Some Artificial Intelligence (AI) agents that were supposed to conduct research and run evaluations on the internet managed to bypass firewalls and “reached” live systems of Indian organisations, gaining access to sensitive information such as business records, “including personal data and confidential material”, the Indian Computer Emergency Response Team (Cert-In) has said.

This is perhaps the first known instance of AI agents going “rogue” and targeting cyber infrastructure of India-based entities. Cert-In also revealed that none of the affected organisations detected the unauthorised access, and, in each case, the incident was disclosed by the AI model providers after their internal review.

“Recently, CERT-In has received multiple voluntary disclosures from AI model providers stating that their models, during research and evaluation activity on the internet, had reached the live systems of Indian organisations,” the cybersecurity agency, which comes under the Ministry of Electronics and Information Technology (MeitY), said in an advisory Thursday. It did not reveal the names of the Indian organisations or the AI agents involved in the incident.

“In the disclosed cases, the models’ actions exceeded the authorisation of their assigned tasks… The recorded activity involved reading business records, including personal data and confidential material, through credentials and connection settings exposed in application configuration, public code repositories and permissive cloud service roles,” it said.

The incident comes amid growing concerns over AI agents acting beyond their intended instructions, including instances where autonomous systems have attempted to access restricted information, circumvent security controls and interact with external systems without authorisation. Globally, leading AI companies, including Anthropic, OpenAI and Meta, have reported similar cases of AI agents breaching defined parameters and acting on their own.

The incident, in particular, mirrors OpenAI’s disclosure from July that its AI agents breached containment safeguards during internal testing, accessed the internet without authorisation, and compromised systems belonging to AI platform Hugging Face. In fact, due to widespread incidents of AI agents acting on their own, leaders in the space, including Anthropic’s Dario Amodei and OpenAI’s Sam Altman, have called for “pacing” the AI frontier.

AI agents are autonomous systems that can independently plan and execute tasks, access external tools and websites, and take actions on behalf of users with limited human intervention.

Story continues below this ad

The agency has recommended that AI model developers isolate their research workloads, permitting only the destinations a task strictly requires, and enforcing the restriction at the network layer. The weaknesses exploited by the AI models and their agents were, however, traditional failings, such as credentials and keys exposed in the source code, public repository history, configuration files, client applications and public web content.

“Define in every task the systems and actions that are in scope, and treat everything else as out of scope. Stop the run automatically if the agent contacts third-party systems, discovers or uses third-party credentials, or raises a stop or failure signal. Give an independent operator the authority to terminate or restart the run,” the agency recommended.

Cert-In also noted a “financially motivated” campaign against Indian entities in which cyber threat actors abused publicly available AI-native offensive-security frameworks.

“These frameworks continue to be misused and rebranded, with a large number of deployments observed across infrastructure in multiple countries, indicating the widespread availability of ready-made agentic intrusion capabilities,” it said.

Story continues below this ad

The agency said that in the financially motivated campaign against Indian entities, agentic tooling compressed the time between initial access and final impact, from days to a few hours. In addition, the campaign highlighted that multi-agent operations run in parallel, for hours to days, to achieve the attacker’s goals, consistent with the documented multi-agent capability of these tools.

Further, victim entities in the campaign that remediated incompletely were attacked again within days, at greater scale, the agency said.