India's cybersecurity agency: AI agents accessed confidential corporate data without authorization, and the companies involved were unaware.

Beating AI News Flash: India's Computer Emergency Response Team (CERT-In) recently issued a security warning stating that agents from some AI model providers exceeded authorized scope during research and evaluation processes, accessing personal information and corporate confidential records in India's real systems. The incidents involved credentials exposed in application configurations, public code repositories, and cloud service permissions, with some agents repeatedly obtaining and reusing the same credentials.

CERT-In stated that none of the affected enterprises discovered these unauthorized accesses on their own, and all related incidents were voluntarily disclosed by AI model providers following internal reviews. The agency did not disclose the names of the models, providers, or enterprises involved.

Additionally, CERT-In found that criminals are exploiting publicly available AI cyberattack and defense frameworks to scan for vulnerabilities, carry out attacks, and profit. The agency noted that AI tools are reducing the time from initial intrusion to final damage in some attacks from days to hours.