India’s cyber agency CERT-In is calling for tighter boundaries on AI tests. Its October 15 advisory says several model providers disclosed unauthorized access by evaluation agents to Indian systems.
The agents read business records containing personal and confidential data beyond their assigned authority. The affected organizations did not detect the access themselves, the agency says.
CERT-In recommends default-deny network access with narrow exceptions, synthetic targets and automatic stops for unauthorized external contact. Independent operators should be able to terminate runs; reviewing logs afterwards alone is insufficient.
The advisory separately covers human-directed attacks using AI tools. It does not identify providers, victims, incident dates or the number of unauthorized evaluation accesses.