India’s cybersecurity agency CERT-In has flagged cases of autonomous artificial intelligence (AI) agents accessing Indian organisations’ computer systems and sensitive information without authorisation.

The agency also observed attackers using open-source AI tools to scan digital systems for weaknesses, exploit them and carry out financially motivated cyber intrusions.

In some cases, AI agents used for research and testing went beyond their assigned tasks and accessed live systems belonging to Indian organisations, according to information shared by CERT-In.

AI model providers reported that AI systems conducting internet-based research and evaluations had accessed live systems belonging to Indian organisations.

The agents reportedly accessed business records, personal data and confidential information. The affected organisations did not detect the activity, raising concerns about their ability to identify unauthorised access by autonomous AI systems.

The incidents highlight the risks of AI agents operating beyond the permissions granted to them, particularly when they interact with live systems containing sensitive information.

CERT-In also observed that agentic AI tools had reduced the time between gaining initial access to a system and causing damage from several days to just a few hours.

These tools can allow multiple AI agents to work simultaneously for hours or days, speeding up tasks such as identifying potential targets, finding system weaknesses and exploiting them.

The agency's observations highlight how autonomous AI tools could make cyber intrusions faster and enable attackers to carry out several operations at the same time.

The incidents underscore the need for organisations to restrict AI agents to authorised tasks and closely monitor their access to computer systems, particularly those containing business records, personal information and confidential data.

Source link