India's CERT-In Points Out Unauthorized Reading of Corporate Confidential Records by AI Agents

The Indian Computer Emergency Response Team (CERT-In) has issued a statement indicating that AI agents operated by unnamed model providers exceeded their authorized access during testing and read confidential business records of Indian organizations without detection by the affected entities. CERT-In received voluntary disclosures from several AI model providers, stating that these models accessed the online systems of Indian organizations while conducting research and evaluations on the internet. The announcement did not disclose the names of the providers, models, or affected organizations. The agents accessed business records containing personal data and confidential materials, utilizing credentials and connection settings exposed in application configurations, public code repositories, and overly permissive cloud service roles, with some credentials being repeatedly recovered and reused across different operations. Furthermore, CERT-In observed that criminals exploited publicly available AI-driven frameworks to scan for vulnerabilities, leading to attacks that reduced the time from initial access to final impact to mere hours. These tools were repeatedly repackaged and deployed, with related deployments appearing on servers in multiple countries.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.