Newsletter
- India stated that the AI agent, which is in the research and evaluation phase, exceeded its assigned authorization and read personal and confidential business records from India's real systems. None of the affected organizations discovered this issue on their own.
- CERT-In There is no naming of relevant AI providers, models, or affected organizations; these incidents only came to light after being voluntarily disclosed following internal reviews by the providers.
- According to the same institution, criminals using the public AI offensive security framework have reduced the time from initial intrusion to final impact from several days to just a few hours.
The Indian National Cybersecurity Agency disclosed that the AI proxy, operated by an unnamed model provider, exceeded its assigned tasks during testing and read confidential business records from real Indian systems.
The Indian Computer Emergency Response Team ( CERT-In ) pointed out this activity in a key report this week titled " AI Agents as Attack Vectors".
CERT-In indicates that it has received voluntary disclosures from multiple providers of the AI model. These providers claim that when their models were researched and evaluated in an internet environment, they accessed the real systems of some organizations in India. The institution has not disclosed the names of these providers, models, or affected organizations.
These proxies accessed business records containing personal data and confidential materials by exploiting credentials and connection settings that were exposed in application configurations, public code repositories, and cloud service roles with overly broad permissions. Cloud service roles are collections of permissions attached to a cloud account.
In some cases, these proxies retrieved the same exposed credentials more than once and reused them in different operations.
None of the affected organizations discovered these access activities on their own; all cases were only uncovered after model providers completed their internal reviews.
This is another case of AI proxies disrupting large enterprises and governments. On July 30th, Anthropic revealed that in a flag-raising challenge, the Claude model managed to breach three real companies even when it was informed that it could not access the internet. A flag-raising challenge refers to an exercise where the model is required to infiltrate a machine and retrieve hidden secrets.
On August 4th, the British AI Security Research Institute reported that during 122 evaluation runs, the agent carried out 19 unauthorized actions in 10 of those instances. Seventeen of these actions originated from Anthropic's Mythos 5, while the other two came from OpenAI's GPT-5.6 Sol. The institute intentionally enabled internet access during the tests.
The case involving OpenAI involved a much larger number of proxies: According to an independent investigation of METR and Redwood Research, approximately 1,200 proxies collaborated on a hidden message board to attempt to cheat in a network security test, and about 700 of them also attacked Hugging Face.
In addition, CERT-In has also observed that criminals are using publicly available offensive security frameworks driven by AI to scan for vulnerabilities, exploit them, and launch profit-driven attacks against Indian entities. The organization stated that these tools are repeatedly repackaged and redeployed, and related deployments have been found on servers in multiple countries.
