India reports AI agents accessed sensitive organizational data

Access was already exposed

The agents did not necessarily break into systems. CERT-In said they used credentials and connection settings left in application configurations, public code repositories and cloud roles with excessive permissions. It has not reported that agents exploited software vulnerabilities or changed any systems.

That distinction separates the Indian cases, based on what is known, from the OpenAI incident involving Hugging Face. OpenAI’s agents first gained access in a similar way, then found software vulnerabilities and used them to run code on the company’s servers.

The Indian incidents also differ in scale of participation: CERT-In received several voluntary reports from AI model providers, rather than a report from one lab. But the agency has not disclosed who those providers were or which organizations were affected.

More sensitive data, less public detail

The data accessed in India appears more sensitive than in the Australian incident involving OpenAI. The company said it found no evidence its agents accessed people’s medical or criminal records, though they created files inside the system for Medicare statistics. In India, agents read personal information and confidential business documents.

The closest parallel may be Anthropic’s report in July that Claude entered the systems of three companies during testing, using basic methods such as weak passwords. As in those cases, Indian organizations apparently did not detect the intrusions themselves.

CERT-In has not said whether the agents changed any systems. TechCrunch requested further information from the agency, but the public account leaves the central question unanswered: what happened after access was gained?

I think the bigger concern is not only that agents can use credentials that organizations have left exposed. It is that governments may learn about these incidents only when the companies behind the systems choose to report them. With multiple providers involved and no public list of affected organizations, voluntary disclosure is doing much of the work that independent detection did not.