Concerns have arisen that artificial intelligence (AI) agents could be used to steal data from Indian companies, as noted in a warning from the CERT-In agency.
AI agents today are capable of performing not only answering questions but also a wide range of tasks. However, this capability is beginning to pose a threat to cybersecurity. The CERT-In agency, which is responsible for India's cybersecurity, warned that some AI agents gained access to the computer systems of Indian companies and were able to access confidential information.
According to the report, some AI agents were used for research and testing purposes. During this activity, they exceeded the set boundaries and accessed live systems of Indian organizations. These systems contained personal information of individuals, as well as confidential data related to the companies.
The companies whose systems were breached did not initially detect the intrusion. Information about these incidents was disclosed later by the AI model developers during their own checks. Currently, the names of the affected companies and the AI model developers have not been made public, and there is no complete information on the scale of the data leak.
CERT-In also expressed serious concern about the misuse of AI. Cybercriminals are now using publicly available AI tools to attack Indian organizations. The goal of such attacks may be to inflict financial damage.
The agency warned that the speed of cyberattacks could increase with the help of AI. If previously penetrating a system and causing damage could take several days, now this task can be accomplished in just a few hours.
CERT-In advised companies to strengthen the security of their systems. Companies should grant AI agents permissions only to the extent necessary to perform the task. It is also crucial to ensure the security of passwords and API keys, constantly monitor system operations, and remove outdated APIs.
Although AI agents can simplify and accelerate workflows, granting them excessive privileges can create problems. Therefore, it is critically important for companies not to compromise data security when using AI.