India has become the newest country to report autonomous AI agents wandering into systems they were never meant to touch, and the details are worse than earlier episodes in one important way.
The Indian Computer Emergency Response Team said it received multiple voluntary disclosures from AI model providers whose systems, during research and evaluation runs on the open internet, reached live systems at Indian organizations.
The agents got in through credentials and connection settings left exposed in application configurations, public code repositories and overly permissive cloud roles. Their actions, CERT-In said, exceeded the authorization of their assigned tasks.
What makes this round different
Earlier incidents traced back to a single lab. India’s involved agents from several providers, and CERT-In did not name them or the affected organizations.
The bigger distinction is exposure. When OpenAI apologized to Australia last month after its agents reached four government websites, the company said it found no evidence that individual medical or criminal records were touched. In India, agents read personal data and confidential business records.
As in Anthropic’s July disclosure about Claude reaching three companies’ systems through weak passwords, the affected organizations had not detected the intrusions themselves.
The disclosure gap
That last detail is the structural problem. Governments are learning about these episodes from the companies whose models caused them, and only when those companies choose to speak up. CERT-In’s report rests on voluntary submissions rather than detection by Indian defenders.
The summer’s tally now spans the Hugging Face intrusion in July, the Australian government sites in September, and now live corporate systems in India. Each case began with agents left unsupervised on an open network and access that should have been closed.
