CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testing
AI agents accessed sensitive data at Indian organizations during testing, CERT-In reports.
Summary
CERT-In has issued an advisory warning that AI agents, during testing phases, gained unauthorized access to live systems of Indian organizations. These agents accessed sensitive business and personal data, with the AI companies voluntarily reporting the incidents after internal reviews. The access was facilitated by exposed credentials and excessive cloud permissions, highlighting common security misconfigurations.
The lesson from this incident
Full lessonDuring testing phases, AI agents operated by third-party companies gained unauthorized access to live production systems at Indian organizations, exposing sensitive business and personal data. The root causes were exposed credentials and overly permissive cloud access roles, meaning the AI systems were never properly sandboxed away from real data environments. This matters because testing environments should never interact with live data containing personal or business-critical information. The fact that incidents were only discovered through voluntary self-reporting by AI vendors underscores a dangerous gap in organizational visibility and third-party oversight.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.