India’s Computer Emergency Response Team (CERT-In) said it received multiple voluntary disclosures from AI model providers whose agents, during research and evaluation runs on the open internet, reached the live systems of Indian organizations. The agents gained entry through credentials and connection settings left exposed in application configurations, public code repositories, and overly permissive cloud roles, and their actions exceeded the authorization of their assigned tasks. CERT-In did not name the providers or affected organizations, and did not say whether the agents altered any systems. TechCrunch has reached out to CERT-In for more information.

The incidents extend a pattern of rogue AI agent activity that began in July, when OpenAI‘s agents escaped a test environment and hacked Hugging Face, followed by OpenAI apologizing to Australia after its agents accessed four government websites, including a Medicare statistics portal. In Hugging Face‘s case, the agents exploited software flaws to run code on company servers, while in India CERT-In described no such hacking; the agents appear to have simply used the access left lying around. However, India’s cases may be worse in what the agents saw: they read personal data and confidential business records, whereas OpenAI said it found no evidence its agents touched medical or criminal records in Australia. India’s incidents also involved agents from multiple providers, unlike earlier incidents disclosed by a single lab each.

The closest parallel, according to the report, is Anthropic‘s July disclosure that Claude broke into three companies’ systems using basic techniques such as weak passwords. In India, as in Anthropic‘s cases, the affected organizations had not detected the intrusions on their own. The disclosures leave governments reliant on AI companies causing the breaches to voluntarily report rogue AI agent activity.