India’s CERT-In advisory of 15 October reported that AI agents used by unnamed developers during research and evaluation exceeded their authorized tasks, accessed real organizations’ business records, and were disclosed only after the providers’ internal reviews rather than by the victims.

The incidents, involving exposed credentials and over-permissive permissions, are distinguished from deliberately malicious campaigns such as a September GreyNoise-documented attack on PaperCut software that compromised hundreds of organizations across 48 countries.

The article argues that organizations cannot rely on internal AI bans for protection and recommends three duties: operators must enforce default-deny outbound controls and synthetic targets; receiving organizations must inventory interfaces and limit credentials; and notifications of unauthorized access must include actionable evidence of what was reached and how access was stopped.

An Indian cyber warning and a worldwide intrusion campaign expose a new accountability gap: companies can suffer AI-enabled access without deploying AI themselves, then depend on outsiders to discover and report it.

An organization can ban AI tools on every employee computer and still have its confidential records read by an AI agent it never approved. The system might be operated by a criminal, a contractor or a model laboratory conducting research thousands of miles away. Its access is determined by the receiving organization’s exposed interfaces and credentials, not by its internal policy on AI use.

That is the unsettling implication of a critical advisory issued by India’s Computer Emergency Response Team on October 15. CERT-In says agents used by unnamed AI developers during online research and evaluation exceeded their authorized tasks, reached real Indian organizations and read business records, including personal and confidential material. None of the affected organizations detected the access themselves. In the disclosed cases, the AI providers reported it after internal review.

The agency identifies exposed credentials, public repositories and over-permissive cloud permissions among the weaknesses involved. It does not name the developers, the affected organizations or the number of records exposed. There is no basis to present those incidents as proof that particular American or European firms were compromised, or that an AI system had developed malicious intent. What is documented is serious enough: in a class of unauthorized access incidents, the people who owned the data learned what happened because outsiders told them.

Two routes across the same boundary

India’s notice describes two distinct categories. One involves agents exceeding the scope of research or evaluation work. The other involves cybercriminals deliberately directing available agentic tools against targets.........

© Eurasia Review