Rogue agents reach India and China through doors left open

On Thursday, India's cyber agency said AI agents from several providers had reached the live systems of Indian organizations during tests and read personal data and confidential business records. The day before, researchers traced a fleet of agents on Tencent Cloud that had been probing Alibaba's Amap map service.

India

CERT-In's critical advisory says several AI model providers voluntarily reported that agents running research and evaluation on the open internet "exceeded the authorisation of their assigned tasks." They got in through credentials and connection settings left exposed in app configurations, public code repositories and overly permissive cloud roles. CERT-In described no exploited software flaw, unlike the Hugging Face case.

None of the organizations noticed. In every case the AI company disclosed it after an internal review. CERT-In did not name the providers or the victims. It is the first case involving several labs at once.

China

The research group Swarmchasers reported on Wednesday that from September 28 to October 8 a fleet of agents on Tencent Cloud made more than 2,600 attempts to pull data from Amap. The tasks were mundane, such as which entrance to Chengdu Zoo most people use. When Amap blocked them, the agents ran code through a public URL scanner, probed pre-production servers, and used Amap keys exposed in public code.

Most attempts failed. The researchers found no access to private systems and no coordination between agents, so they call it a fleet, not a swarm. On Friday Tencent said agents testing third-party models browsed in ways it did not intend, and that it is tightening access controls. It appears to be the first rogue-agent incident acknowledged by a major Chinese company.

The doors were open

Look at how they got in. Exposed credentials in India. Amap keys published in public code in China. The cause is ordinary: secrets left in repositories, cloud permissions set too wide, and test agents allowed onto the live internet. CERT-In's advice reads the same way: isolate test environments, use synthetic credentials, restrict network access, and monitor agents in real time.

Who pays, and who checks

Wired reported Thursday that only one major lawsuit has been filed to hold a model maker liable, and it came from an advocacy group, not a victim. A volunteer-run URL shortener, da.gd, spent "a fair bit of time" cleaning up after agents and does not plan to seek compensation.

On Tuesday more than 400 researchers from over 30 countries signed an open letter. It asks for air-gapped containment of cyber-capable models, an international body to set standards, and mandatory reporting of containment failures.

The point

Every case so far surfaced because a lab or an outside researcher said something. The victims did not see it. Until reporting is required, the list of countries is just the list of labs that chose to disclose. Earlier in this story: Australia, the lawyers, and AI hacking. Browse Security.