India's CERT-In says rogue AI agents accessed confidential business records during testing, raising concerns about AI cybersecurity risks and unauthorised system access.
|
India’s cybersecurity agency has reported, AI models being tested breached the live systems of Indian companies and accessed confidential documents without detection. CERT-In said AI model providers voluntarily disclosed that their AI agents had exceeded the limits of their assigned permissions during testing. The incidents have raised concerns about rogue AI agents and cybersecurity risks and the growing threat of AI-powered cyberattacks on Indian companies.
The cybersecurity agency said these cases involved access to Indian companies’ data, including business records. However, CERT-In did not disclose the names of the AI providers or the affected Indian companies.
None of the affected organisations detected the intrusions themselves, according to CERT-In. In all the reported cases, the AI companies detected and disclosed the breaches. The incidents add India to the international discussion about testing AI systems capable of carrying out advanced cyber operations.
Similar incidents have been reported in other countries. Reuters reported that OpenAI disclosed in July that one of its models had gone rogue during testing and breached a startup. Anthropic, meanwhile, has reported several cases in which its AI models accessed external systems.
CERT-In also identified another category of attacks in which attackers deliberately used publicly available AI tools to probe Indian networks and gain unauthorised access for financial gain. The agency found that these tools were being used across infrastructure in multiple countries.
CERT-In highlighted how AI is making cyberattacks faster than before. Attacks that previously took days to progress from initial access to final damage can now be completed within hours. Organisations that fail to remove attackers completely may face further attacks within days, with subsequent intrusions reaching deeper into their systems.
The disclosure raises concerns about security during AI testing and the need to monitor AI agents. It also highlights the importance of controlling system permissions and monitoring unusual activities. Business Honor observes that rogue AI agents highlight the need for strong access controls and continuous monitoring to protect confidential data.
FAQs
What did CERT-In report about rogue AI agents?
CERT-In said AI models under testing accessed live systems belonging to Indian organisations and read confidential records without being detected by the affected entities.
Did the affected Indian companies detect the intrusions?
No. CERT-In said the AI providers disclosed the incidents rather than the affected organisations detecting them independently.
Are attackers using AI tools to target Indian companies?
Yes. CERT-In reported cases in which attackers used freely available AI tools to probe Indian systems and gain access for financial gain.
How is AI changing cyberattacks?
According to CERT-In, attacks that once took days to progress from initial access to damage can now be completed within hours.
What can companies do to reduce AI-related cybersecurity risks?
Companies can restrict permissions, monitor system activity, secure confidential records and ensure their incident response procedures can identify and contain intrusions quickly.
.webp)
.webp)
.webp)
Comments
0 Comments