Rogue AI agents broke into Indian firms' live systems, government says
Why This Matters
Key context: <p>AI models under test broke into Indian organisations’ live systems and read confidential records undetected, India’s cybersecurity agency said, the country’s first such official account after similar incidents of <a href="https://www.dawn.com/news/2034110">rogue AI behaviour</a> worldwide.</p> <p>AI model providers had voluntarily disclosed that their agents “exceeded the authorisation of their assigned tasks” during test runs to access Indian firms’ data, including business records, the Indian Computer Emergency Response Team (CERT-In) said late on Thursday.</p> <p>It did not name the providers or the affected organisations.</p> <figure class='media w-full sm:w-1/2 media--right media--embed media--uneven' data-original-src='https://www.dawn.com/news/2020280'> <div class='media__item media__item--newskitlink '> <iframe class="nk-iframe" width="100%" frameborder="0" scrolling="no" style="height:250px;position:relative" src="https://www.dawn.com/news/card/2020280" sandbox="allow-same-origin allow-scripts allow-popups allow-modals allow-forms"></iframe></div> </figure> <p>The disclosure brings India into a growing global debate over how AI companies test models with advanced hacking abilities.</p> <p>OpenAI said in July its models <a href="https://www.dawn.com/news/2017667">went rogue</a> during testing and breached a startup, while Anthropic has disclosed at least four <a href="https://www.dawn.com/news/2019688"><u>instances</u></a> of AI models’ hacking external systems so far this year.</p> <p>OpenAI has also apologised for the <a href="https://www.dawn.com/news/2032457">hacking</a> of an Australian government website by its rogue AI agent.</p> <p>None of the affected Indian entities detected the intrusions themselves, and in every case it was the AI companies that flagged the incidents, CERT-In said.</p> <p>In a second set of cases, the government agency’s own investigations found attackers deliberately using freely available AI tools to probe Indian systems and break in for financial gain, with such tools deployed widely across infrastructure in multiple countries.</p> <figure class='media w-full sm:w-1/2 media--right media--embed media--uneven' data-original-src='https://www.dawn.com/news/2035566'> <div class='media__item media__item--newskitlink '> <iframe class="nk-iframe" width="100%" frameborder="0" scrolling="no" style="height:250px;position:relative" src="https://www.dawn.com/news/card/2035566" sandbox="allow-same-origin allow-scripts allow-popups allow-modals allow-forms"></iframe></div> </figure> <p>Attacks that once took days from first entry to final damage were compressed to a few hours, CERT-In said, and victims that failed to fully clean up were attacked again within days, at greater depth.</p> This development from dawn.com highlights ongoing changes in the sector.
AI models under test broke into Indian organisations’ live systems and read confidential records undetected, India’s cybersecurity agency said, the country’s first such official account after similar incidents of rogue AI behaviour worldwide. AI model providers had voluntarily disclosed that their agents “exceeded the authorisation of their assigned tasks” during test runs to access Indian firms’ data, including business records, the Indian Computer Emergency Response Team (CERT-In) said late on Thursday. It did not name the providers or the affected organisations. The disclosure brings India into a growing global debate over how AI companies test models with advanced hacking abilities. OpenAI said in July its models went rogue during testing and breached a startup, while Anthropic has disclosed at least four instances of AI models’ hacking external systems so far this year. OpenAI has also apologised for the hacking of an Australian government website by its rogue AI agent. None of the affected Indian entities detected the intrusions themselves, and in every case it was the AI companies that flagged the incidents, CERT-In said. In a second set of cases, the government agency’s own investigations found attackers deliberately using freely available AI tools to probe Indian systems and break in for financial gain, with such tools deployed widely across infrastructure in multiple countries. Attacks that once took days from first entry to final damage were compressed to a few hours, CERT-In said, and victims that failed to fully clean up were attacked again within days, at greater depth.
Curation & Context
This page summarizes a public news report from dawn.com. Global News Hub provides the "Why This Matters" takeaway using editorial insights and AI curation to give readers rapid, high-value context before they click through to read the full article.