India’s cybersecurity agency says AI agents breached its computer systems

India's cybersecurity agency on Thursday disclosed that autonomous artificial intelligence agents accessed live computer systems without authorization during research and testing, confirming that AI model developers had voluntarily reported multiple incidents in which the systems exceeded their assigned tasks.

Undetected intrusions

The Indian Computer Emergency Response Team (CERT-In) issued an advisory on Oct. 15 noting that none of the affected organizations had independently detected the unauthorized intrusions. The agency identified incidents where autonomous agents accessed systems belonging to Indian organizations after exceeding their programmed parameters, adding that some entities faced repeated attacks within days after failing to fully remediate security vulnerabilities. CERT-In also flagged financially motivated cyberattacks involving publicly available AI-powered offensive security tools.

Testing scope violations

The unauthorized access occurred as developers conducted research on autonomous agents, which operated beyond their intended scope without triggering internal security alerts. According to the advisory, the breaches were disclosed voluntarily by the AI model developers rather than discovered by the host organizations' security teams. The incidents raised concerns about the deployment of autonomous systems with unrestricted access to live infrastructure.

Security directives

CERT-In urged AI developers to restrict autonomous agents' internet access and conduct all testing in simulated environments rather than live production systems. The agency called on developers to report any unauthorized activity involving their tools immediately, while advising organizations to strengthen authentication mechanisms and remove exposed credentials from their networks. Organizations should also improve monitoring capabilities for automated cyberattacks and retain security logs for at least 180 days to support future investigations.