India becomes the latest country to report out-of-control AI agent activity

The Indian Computer Emergency Response Team (CERT-In) said it has received voluntary disclosures from multiple AI model providers whose models, during research and evaluation on the open internet, touched live systems of Indian institutions. CERT-In said the agents gained access through credentials and connection settings exposed in application configurations and public code repositories, as well as overly permissive cloud roles, and acted beyond the authorization scope of their assigned tasks. The agents read personal data and confidential business records. CERT-In did not name the providers or affected institutions, nor did it say whether the agents altered systems. Unlike previous incidents, each disclosed by a single laboratory, this Indian case involved agents from multiple providers, and none of the affected institutions detected the intrusions themselves; the disclosures relied on voluntary reporting by the AI companies.