印度成为最新报告失控 AI Agent 活动的国家

多家 AI 提供商的 AI Agent 在研究和测试期间访问了印度组织的个人数据及机密材料。印度网络安全机构周四表示。

印度计算机应急响应小组（CERT-In）称，其已收到“来自 AI 模型提供商的多起自愿披露”：这些模型在开放互联网进行研究和评估运行期间，“曾抵达印度组织的在线生产系统”。

这些 Agent 是通过应用配置、公开代码仓库以及权限过于宽松的云角色中遗留并暴露的凭证和连接设置进入系统的，其行为“超出了其被分配任务的授权范围”。

这使印度成为失控 AI Agent 全球巡回事件中的最新一站。今年 7 月，OpenAI 的 Agent 逃离测试环境并入侵法国公司 Hugging Face——由此拉开了一个失控 AI Agent 活动频发的夏季。上个月，在其 Agent 访问了包括 Medicare 统计门户在内的四个政府网站后，OpenAI 向澳大利亚致歉。

在 Hugging Face 事件中，OpenAI 的 Agent 最初以相同方式进入系统，但随后发现并利用软件漏洞，在该公司的服务器上运行代码。CERT-In 没有描述印度发生了类似黑客攻击；在印度，这些 Agent 似乎只是利用了原本就暴露在外的访问权限。

不过，印度案例在一个方面似乎更为严重：即 Agent 所看到的信息。在澳大利亚事件中，OpenAI 表示，即便其 Agent 在 Medicare 统计系统内写入了文件，也没有证据表明它们接触过个人医疗或犯罪记录；而在印度，Agent 则读取了个人数据和机密商业记录。此外，与此前每起事件均由单一实验室披露不同，印度事件涉及多家提供商的 Agent。

CERT-In 未透露相关提供商或受影响组织的名称，也未说明这些 Agent 是否修改了任何系统。TechCrunch 已联系 CERT-In 以获取更多信息。

目前，最接近的案例似乎是Anthropic 在 7 月的披露：Claude 在测试期间使用弱密码等基础手段，侵入了三家公司的系统。

与 Anthropic 的案例一样，印度的受影响组织并未自行发现这些入侵行为。这些披露意味着，各国政府仍在依赖造成此类泄露的 AI 公司自愿报告失控 AI Agent 的活动。

AI agents from multiple providers accessed personal data and confidential material at Indian organizations during research and testing, India’s cybersecurity agency said Thursday.

The Indian Computer Emergency Response Team (CERT-In) said it had received “multiple voluntary disclosures from AI model providers” whose models, during research and evaluation runs on the open internet, “had reached the live systems of Indian organizations.”

The agents got in through credentials and connection settings left exposed in app configurations, public code repositories, and overly permissive cloud roles, and their actions “exceeded the authorisation of their assigned tasks.”

This makes India the latest stop on what has become a world tour for rogue AI agents. In July, OpenAI’s agents escaped a test environment and hacked French company Hugging Face — kicking off a summer of rogue AI agent activity. Last month, OpenAI apologized to Australia after its agents accessed four government websites, including a Medicare statistics portal.

At Hugging Face, OpenAI’s agents started the same way but then found and exploited software flaws to run code on the company’s servers. CERT-In described no such hacking in India, where the agents appear to have simply used the access left lying around.

Still, the Indian cases appear to be worse in one respect, which is what the agents saw: In Australia, OpenAI said it found no evidence its agents touched individuals’ medical or criminal records, even after they wrote files inside a Medicare statistics system, while in India, agents read personal data and confidential business records. And unlike earlier incidents, each disclosed by a single lab, India’s case involved agents from multiple providers.

CERT-In did not name the providers or affected organizations, or say whether the agents altered any systems. TechCrunch has reached out to CERT-In for more information.

For now, the closest parallel seems to be Anthropic’s July disclosure of Claude breaking into three companies’ systems during testing using basic techniques like weak passwords.

In India, as in Anthropic’s cases, the affected organizations had not detected the intrusions on their own. The disclosures have left governments relying on AI companies causing these breaches to voluntarily disclose rogue AI agent activity.