The disclosure brings India into a growing global debate over how AI companies test models with advanced hacking abilities. OpenAI said in July its models went rogue during testing and breached a startup, while Anthropic has disclosed at least four instances of AI models’ hacking external systems so far this year.
Bengaluru: AI models under test broke into Indian organisations’ live systems and read confidential records undetected, India’s cybersecurity agency said, the country’s first such official account after similar incidents of rogue AI behavior worldwide.
Indian Computer Emergency Response Team (CERT-In) has issued a “critical” advisory after autonomous artificial intelligence agents were found accessing without any authorisation, the live systems and confidential data that belonged to Indian organisations.
India’s cybersecurity agency identified two separate patterns of attacks involving the information and communication technology infrastructure of Indian entities.
As per AI model providers’ account of incidents, autonomous models and agents under research and evaluation reportedly exceeded the scope of their authorised tasks, CERT-In said in its advisory CIAD-2026-0049, titled AI Agents as Attack Vectors.
The agents accessed business records containing personal and confidential information using credentials and connection settings exposed in application configurations, public code repositories and overly permissive cloud roles.
CERT-In said none of the affected organisations detected the unauthorised access themselves, but found out about them after the AI model providers conducted internal reviews.
Separately, CERT-In’s own threat-hunting efforts found cybercriminals using publicly available AI-native offensive-security frameworks to conduct reconnaissance, exploit vulnerabilities and run financially motivated campaigns against Indian entities.
The tools have also been repackaged and deployed on servers in multiple countries, it said.
The agency warned that exposed credentials could be recovered and reused in separate operations.
CERT-In has advised organisations to audit source code, repositories and commit histories, configuration files, client applications and cloud storage for exposed credentials.
It also recommended rotating compromised credentials, removing them from code history, disabling dormant or test APIs, enforcing least-privilege access and taking administrative interfaces off the public internet.
Following credential exposure or a confirmed intrusion, CERT-In said systems should be treated as compromised until “forensically cleared”, with repeat attempts expected within days or weeks.
AI model providers had voluntarily disclosed that their agents “exceeded the authorisation of their assigned tasks” during test runs to access Indian firms’ data, including business records, the Indian Computer Emergency Response Team (CERT-In) said late on Thursday.
It did not name the providers or the affected organisations.
The disclosure brings India into a growing global debate over how AI companies test models with advanced hacking abilities. OpenAI said in July its models went rogue during testing and breached a startup, while Anthropic has disclosed at least four instances of AI models’ hacking external systems so far this year.
OpenAI has also apologised for the hacking of an Australian government website by its rogue AI agent.
None of the affected Indian entities detected the intrusions themselves, and in every case it was the AI companies that flagged the incidents, CERT-In said.
In a second set of cases, the government agency’s own investigations found attackers deliberately using freely available AI tools to probe Indian systems and break in for financial gain, with such tools deployed widely across infrastructure in multiple countries.
Attacks that once took days from first entry to final damage were compressed to a few hours, CERT-In said, and victims that failed to fully clean up were attacked again within days, at greater depth.
Organisations must test AI agents in isolated environments, tightly limit what they can access and keep humans in the loop, industry analysts and cybersecurity firms said, after CERT-In issued a ‘critical’ advisory warning that autonomous AI agents have accessed live systems and confidential data of Indian organisations without authorisation.
Experts said the real risk is that agents can reach sensitive data beyond their permissions without organisations even realising it, a gap that could affect everyday users as AI tools increasingly handle personal information.