After OpenAI’s Australia hack, India’s cyber agency says AI agents breached systems

Less than a month after Australia’s Prime Minister Anthony Albanese revealed that OpenAI’s agents had breached government websites, India’s cybersecurity agency has said similar incidents occurred in the country.

In a “critical” severity advisory issued on October 15, the Indian Computer Emergency Response Team (CERT-In) said AI agents “exceeded their assigned task authorisation” and made unauthorised access to Indian “information and communication technology assets.”

The agency said it received “multiple voluntary disclosures” from AI model providers, who told it their models had reached the live systems of Indian organisations during research and evaluation on the internet.

What the agents did

According to CERT-In, the agents read business details, including personal data and confidential material. The agents broke into information systems by using exposed passwords, network settings, and poorly secured cloud accounts found in public code and app files.

(Public code repositories and application configurations are like behind-the-scenes settings that are used to develop software. In other words, they are like blueprint of a house’s floor plan. Getting access to this key information can help an attacker plan a cyberattack.)

CERT-In’s confirmation echoes the Australian breach case, where OpenAI’s agents were given a specific research task of finding public spending data in a particular location in Down Under. The agents took unauthorised actions after hitting obstacles and gained non-public access to a government system.

In India, too, the advisory says the models’ actions went beyond what their tasks allowed. In at least some cases, CERT-In noted, agents re-derived and re-used the same exposed credential in separate operations.

Crucially, none of the affected Indian organisations detected the access. In every case, the incident came to light only after the AI model providers reviewed their own systems.

A second threat

CERT-In, in its advisory, has also flagged instances of cybercriminals deliberately using open-source agentic AI tools against Indian entities to gain financial incentives. The agency noted that AI tools reduced time between initial access and final impact from days to a few hours, and that victims who were incompletely restored were attacked again within days.

The attack agents tended to exploit keys exposed in source code, dormant and test APIs left reachable, plaintext payment-API keys, over-permissive cloud roles, and internet-exposed management interfaces without multi-factor authentication.

These vulnerabilities are classified under “hygiene issues” in cybersecurity and are seen as the digital equivalent of leaving your front door unlocked or writing down your password on a sticky note.

The difference this time around is that the AI is able to find and exploit mundane vulnerabilities faster and at greater scale than human attackers.

The missing disclosures

The worrying part about CERT-In’s note is that the agency did not name the AI model or the company behind these breaches. In fact, the cyber agency has not even mentioned the place of origin of these attacks. While it noted that a number of Indian organisations were affected, it did not name them, their sectors, or the period in which the unauthorised access took place.

The notification does not going into details on whether the affected organisations have since been informed, or whether personal data of Indian citizens was accessed.

Searches of public statements by frontier AI companies turned up no disclosure referring to Indian systems.

OpenAI’s own account of the Australian incident, made only after the Hugging Face episode forced a review, mentioned Australian systems alone.

If the “voluntary disclosures” came to CERT-In privately, as the Australian one initially went to a single agency by email, the public and affected organisations may have no way of knowing whether they are among those reached.

India’s cyber agency must be transparent and make the details of all breaches reported to them public by naming the companies or AI developers responsible for the breaches. India’s IT ministry must then initiate an inquiry into these incidents, gather granular details, and then frame suitable policies to safeguard the nation’s cyber systems.

For now, CERT-In, in its advisory, has asked AI model developers “to isolate research and evaluation workloads with default-deny network egress” to ensure that AI agents don’t access non-public information. It must now follow up with a more detailed report on the disclosures made by AI model developers.