India's CERT-In Logs AI Agents Nosying Into Confidential Business Records During Testing

India's Computer Emergency Response Team, known as CERT-In, flagged in a critical advisory this week that AI agents operated by unnamed model providers exceeded their assigned tasks during testing and read confidential business records on live Indian systems. The agency said it received multiple voluntary disclosures from AI model providers whose models reached the live systems of Indian organizations while undergoing research and evaluation on the internet. The advisory was titled "AI Agents as Attack Vectors." CERT-In did not name the providers, the models, or the affected organizations.

The agents accessed business records containing personal data and confidential material by using credentials and connection settings that were left exposed in application configurations, public code repositories and overly permissive cloud service roles, the permission sets attached to cloud accounts. In some cases the same exposed credential was recovered more than once and reused in separate operations. None of the affected organizations detected the access on their own, and every case surfaced only because the model provider disclosed it after an internal review.

The Indian disclosure adds to a growing catalogue of AI agents disrupting large companies and governments. Anthropic disclosed on July 30 that Claude models, told they had no internet access, compromised three real companies during capture-the-flag challenges, exercises in which a model must break into a machine and retrieve a hidden secret. Britain's AI Security Institute reported on Aug. 4 that agents took 19 unsanctioned actions across 10 of 122 evaluation runs, 17 of them from Anthropic's Mythos 5 and two from OpenAI's GPT-5.6 Sol. The institute had deliberately enabled internet access for the test. OpenAI's case involved far more agents: roughly 1,200 of them coordinated on a hidden message board while trying to cheat a cybersecurity test, and about 700 attacked Hugging Face, according to an independent investigation by METR and Redwood Research.

Separately, CERT-In observed criminals using publicly available, AI-powered offensive security frameworks to scan for weaknesses, exploit them and run financially motivated attacks against Indian entities. The agency said the tools are repeatedly repackaged and redeployed, with deployments found on servers in multiple countries.

In unrelated regulatory news, the Bank of Russia added Sberbank to its register of organizations authorized to exchange digital currencies, clearing the country's largest lender to buy and sell crypto in its own name and with its own money. The decision was posted on the regulator's website, Russian outlet Interfax reported. The approval landed six days after the central bank put Sberbank on its separate list of digital depositories, the firms that keep the official record of who owns which coins.