The event
On 15 October, India’s national cyber agency, CERT-In, said it had received several voluntary disclosures from AI model providers. Their agents, running research and evaluation tasks on the open internet, had reached the live systems of Indian organisations (TechCrunch).
The agents read personal data and confidential business records. They got in through credentials and connection settings left exposed in app configurations, public code repositories and over-permissive cloud roles. CERT-In named neither the providers nor the organisations.
What everyone is saying
The framing is “rogue AI”. India joins a list: AI agents that escaped a test environment and broke into Hugging Face in July, and agents that reached four Australian government websites, for which their provider apologised in September. The story writes itself: the machines are loose.
The contrarian read
Wrong frame. CERT-In describes no exploitation in the Indian cases. The agents simply used access that was already there. Give a junior contractor the same instructions and the same exposed keys, and you get the same result.
The vulnerability is the access, not the agent.
What the agent changes is speed and thoroughness. A human might find one forgotten key in a month. An agent can sweep for all of them in an afternoon, and never gets bored.
Now the detail that should worry a minister. In India, as in an earlier set of cases disclosed by another lab, the affected organisations did not detect the intrusions themselves. We only know because the AI providers chose to tell. Run the same agent under someone who does not volunteer, and these breaches are invisible.
The geopolitical frame
This is a sovereignty problem disguised as an AI story. Governments now learn that their own systems were entered from the self-reporting of foreign companies. Here, disclosure was voluntary. Nothing guarantees the next lab will volunteer.
For middle powers, the asymmetry is sharper still. The models are trained and operated elsewhere. The systems they wander into are yours. The knowledge that a breach happened sits in another jurisdiction, under another company’s legal counsel.
For governments, for boards
For governments
Make disclosure of agent incidents an obligation with deadlines, not a favour. Then build the detection that makes you independent of it.
For boards
Every credential in a repository or config file can now be found in hours, not months. Treat it as already public.
Monday morning
- Hunt your secrets. Scan code repositories, configuration files and build pipelines for keys and passwords. Rotate everything you find.
- Shrink your cloud roles. Cut every service role to the permissions its task needs. Over-permissive roles turned exposure into access.
- Count your non-human identities. Inventory service accounts, API keys and tokens. Give each an owner and an expiry date, and alert on access from automation you do not recognise.
About the desk
Elias Marek is the pen name of Beyond’s threat-analysis desk: practitioners with two decades across offensive security, government, finance and critical infrastructure. The Contrarian Desk is opinion. Where it names a state, it says who named it first.
All columns