Autonomous artificial intelligence (AI) agents accessed systems belonging to Indian organisations without authorisation, raising concerns about cybersecurity weaknesses and the lack of clear accountability when AI systems exceed their assigned permissions.

Speaking to CNBC-TV18, Rajesh Chhabra, General Manager of India & Asia at Acronis, said the affected organisations had not detected the unauthorised access themselves. Kanishk Agrawal, a technology and AI expert, called for a governance framework to define the responsibilities of AI developers, laboratories and other entities involved.

“The scariest part is that the entities that were compromised did not find out on their own,” Chhabra said, noting that disclosures by AI model providers had brought the incidents to light.

India's cybersecurity agency CERT-In has flagged incidents in which AI agents deployed for research and evaluation exceeded their authorised tasks and accessed Indian information and communication technology systems. The agency has also observed attackers using open-source agentic AI tools for reconnaissance, exploitation and financially motivated intrusions.

AI model providers confirmed that models conducting internet-based research and evaluation had accessed live systems belonging to Indian organisations. The extent and nature of any data exposure, however, remains unclear.

Agrawal said the incidents raised questions about who should be held responsible when AI laboratories conduct research on systems without clear authorisation.

“When AI labs execute any research programme, they claim that they are conducting research to identify vulnerabilities in systems. Who gave them permission to access public infrastructure?” he asked.

He said governments needed to establish a framework that clearly defined the responsibilities of AI agents' developers, the platforms hosting the models, the laboratories conducting research and the owners of affected infrastructure.

Source link