Researcher Claims Access to Adalat AI Infrastructure and Code

Cybersecurity researcher Nisarga Adhikary has claimed to have discovered significant vulnerabilities within the systems of Adalat AI, a startup involved in government-backed technology initiatives. Adhikary alleges that these flaws provided him with access to the company's database, storage systems, production infrastructure, credentials, and private source code.

Initially, Adhikary also claimed that sensitive court data was being processed on production servers located in Japan. However, Adalat AI's founders later clarified that the data Adhikary accessed was publicly available research data. Despite this clarification, Adhikary maintained his assertion that the company's deployment, DevOps, production infrastructure, and source code had been compromised.

In a detailed disclosure to Adalat AI, Adhikary outlined what he termed "Critical Security Vulnerabilities." These reportedly included "Full Infrastructure Compromise," "Entire Database/Storage Access," leaked live credentials, Kubernetes cluster-admin access, and access to over 90 internal private source code repositories.

Adhikary's claims have drawn criticism towards the quality of startups promoted by India's Ministry of Electronics and Information Technology (MeitY), suggesting a disconnect between the company's public statements on data sovereignty and the accessed infrastructure. Adalat AI's founders have reportedly acknowledged the vulnerabilities in good faith and agreed to cooperate on fixes, according to Adhikary.

The full scope of the vulnerabilities, their duration, and whether any other parties gained access remain unconfirmed publicly. Adalat AI has not yet released a detailed public statement regarding the incident.