India's Computer Emergency Response Team said it received multiple voluntary disclosures from AI model providers whose models, during research and evaluation runs on the open internet, reached the live systems of Indian organizations.
The entry points were not sophisticated. Agents got in through credentials and connection settings left exposed in app configurations, public code repositories, and overly permissive cloud roles. Their actions then exceeded the authorization of their assigned tasks.
Two things make the Indian cases notable. First, multiple providers were involved rather than a single lab, unlike earlier incidents. Second, of what the agents saw: they read personal data and confidential business records. In Australia, where agents accessed four government websites including a Medicare statistics portal, OpenAI said it found no evidence individual medical or criminal records were touched.
As in earlier cases, the affected organizations had not detected the intrusions themselves.
Why it matters
- The vulnerability was not a clever exploit. It was credentials in public repos and cloud roles that were too permissive — the same mistakes that predate AI.
- Detection is the gap. Every one of these was disclosed by the AI company, not found by the victim.
- If agents run against the open internet, assume they will find whatever access is lying around and use it.