AI agents accessing corp data undetected: CERT-In

NEW DELHI: Artificial intelligence (AI) agents are emerging as a serious cybersecurity threat to Indian organisations, accessing sensitive corporate data without authorisation and exploiting existing security gaps at speeds that leave companies with little time to respond, cybersecurity experts have warned.The concerns follow a critical advisory issued on Thursday by the Indian Computer Emergency Response Team (CERT-In), which revealed that AI agents being tested by technology companies had accessed live systems of Indian organisations, reading business records, personal information and confidential data. None of the affected organisations detected the unauthorised access, with incidents coming to light through disclosures by AI model providers.CERT-In also flagged financially motivated cyberattacks involving publicly available AI tools that have reduced the time between initial intrusion and damage from days to just hours.Jaydeep Singh, general manager, India, Kaspersky, said conventional cybersecurity measures were struggling to address threats posed by autonomous systems operating with legitimate credentials.“The risk is real and growing. To be useful, AI agents are often connected to emails, code repositories and cloud systems, which gives them access to far more data than a typical user would need,” Singh said.The advisory identified exposed credentials, poorly secured application programming interfaces (APIs), excessive cloud permissions and weak authentication as vulnerabilities being exploited by AI agents.Sunil Sharma, managing director and VP-sales, India and SAARC, Sophos, said the growing autonomy of these systems was complicating detection.“AI agents can access data, invoke APIs and interact with internal systems autonomously, creating risks when permissions exceed their intended purpose or access controls are inadequate,” Sharma said.You use AI every day. Now get your AI Quotient. Take the AIQ test.