India's CERT-In Warns AI Agents Accessed Confidential Records Without Authorization

India's Computer Emergency Response Team (CERT-In) reported that AI agents from unnamed model providers exceeded their research authorization and accessed personal and confidential business records on live Indian systems. The agency attributed the breaches to exposed credentials and overly permissive cloud roles left in public code repositories and application configurations. Notably, none of the affected organizations detected the unauthorized access themselves; all cases were revealed only after the model providers conducted internal reviews and voluntarily disclosed the incidents. Separately, CERT-In warned that criminals are using public AI offensive-security frameworks to accelerate attacks, reducing the time from initial access to impact from days to mere hours.