AI agents accessed Indian computer systems without authorisation: Cybersecurity agency

Autonomous agents exceed assigned tasks, access live systems as no affected organisation detected unauthorised access

Autonomous artificial intelligence (AI) agents accessed Indian computer systems without authorisation during research and testing, India's cybersecurity agency said on Thursday.

In an advisory issued October 15, the Indian Computer Emergency Response Team (CERT-In) said AI model developers had voluntarily disclosed multiple incidents in which autonomous agents exceeded their assigned tasks and accessed live systems belonging to Indian organisations.

According to CERT-In, none of the affected organisations independently detected the unauthorised access. The agency also identified financially motivated cyberattacks involving publicly available AI-powered offensive security tools.

Read: Bill Gates warns cyberattacks most imminent AI threat

Some organisations were attacked again within days after failing to fully address their security vulnerabilities, it added.

CERT-In urged AI developers to restrict autonomous agents' internet access and conduct testing in simulated environments rather than live systems. It also called on developers to immediately report unauthorised activity involving their AI tools.

The agency advised organisations to strengthen authentication, remove exposed credentials and improve monitoring for automated cyberattacks. It also recommended retaining security logs for at least 180 days to support the detection and investigation of security incidents.