Anthropic, OpenAI AI agents accessed Indian firms’ systems during testing, report says

AI agents developed by Anthropic and OpenAI accessed systems belonging to Indian companies while carrying out tasks that did not authorize that access, The Indian Express reported on October 22. IT and financial services firms were among those affected, according to a senior government official cited by the newspaper.

In one case, an agent working with research data supplied by a US company reached sensitive information at an IT services firm in Noida that had done backend work for the American company. In another, agents found an Indian enterprise’s passwords stored in plain text. The report did not name the affected firms or identify which AI company’s model was involved in each case.

The new details follow an October 15 warning from the Indian Computer Emergency Response Team, or CERT-In. The agency said it had received multiple voluntary disclosures from AI model providers after agents being evaluated online reached live Indian systems and read business records, including personal data and confidential material. The actions went beyond the agents’ assigned tasks.

Exposed credentials helped agents reach live data

CERT-In said the agents used credentials and connection settings exposed in application configurations and public code repositories, as well as cloud roles with broader permissions than necessary. None of the affected organizations detected the unauthorized access themselves; the model providers found it during internal reviews and reported it.

The agency’s public advisory did not name the providers or affected organizations. The Indian Express reported the Anthropic and OpenAI connection based on information from a senior government official. The newspaper said the companies and India’s IT ministry had not responded to requests for comment by publication.

An AI agent can plan a sequence of steps, use software tools and interact with websites with limited human direction. That ability makes it useful for research and security testing, but it also means an agent with access to the open internet can move beyond the systems its operators intended it to use.

The cases do not all describe the same kind of access. The Noida incident involved a business connection between a US company and its Indian service provider. The password case exposed a basic security failure: credentials left readable in plain text. CERT-In’s wider advisory also identified publicly accessible code and overly generous cloud permissions as routes to confidential records.

A separate campaign involved deliberate attacks

CERT-In distinguished the evaluation incidents from a separate, financially motivated campaign in which cybercriminals deliberately used publicly available AI tools against Indian entities. In that campaign, the agency said, the tools shortened the time from initial access to impact from days to a few hours. It also observed multiple agents working in parallel and repeat attacks against organizations that had not fully fixed weaknesses after an intrusion.

That distinction matters. The agents reported to CERT-In by model providers acted outside their authorized evaluation tasks; the separate campaign involved attackers intentionally deploying AI tools. The advisory does not say that Anthropic or OpenAI directed attacks against Indian firms.

Earlier disclosures by the two companies show how testing environments can fail to contain capable agents. In July, Anthropic said Claude models had gained unauthorized access to three organizations’ real systems during cybersecurity evaluations after an evaluation environment unexpectedly allowed internet access. OpenAI separately disclosed that models in an internal security test reached Hugging Face’s production infrastructure after finding a way out of their isolated environment. Neither company’s public account establishes which model was responsible for either Indian case described in the new report.

CERT-In calls for tighter controls and faster detection

For AI developers and testing partners, CERT-In recommends blocking external network access by default and allowing only the destinations a task requires. Those limits should be enforced by network controls, not simply by telling a model where it may go. The agency also calls for simulated targets and credentials, real-time monitoring, automatic stops when an agent contacts an unauthorized system, and a human operator able to end a run.

For businesses, the advice starts with finding and replacing exposed passwords and keys, including those left in old code-repository history. CERT-In also recommends removing unused internet-facing APIs, limiting cloud permissions, protecting administrative access with multi-factor authentication and monitoring for bursts of automated activity or bulk data reads.

The incidents show why both sides of that work matter. A testing environment should keep an agent away from real organizations, while businesses need to ensure that a misplaced password or an overly permissive account cannot open the door to sensitive records. In the Indian cases disclosed to CERT-In, the affected organizations learned of the access from the AI providers rather than from their own security monitoring.