This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
An ethical hacker identified that sensitive student data from India's Central Board of Secondary Education (CBSE) was being processed by Google Gemini via automation scripts managed by a third-party vendor, COEMPT Eduteck. The incident involved the unauthorized handling of student personal information and answer sheets, leading to concerns regarding data privacy and sovereignty. The CBSE has since stated that the vulnerabilities in the associated portal have been contained.
The Hindu reported that vulnerabilities in the OnMark exam-marking portal used by India's Central Board of Secondary Education (CBSE) allegedly exposed sensitive student data, including answer-sheet images. Ethical hacker Nisarga Adhikary also alleged that COEMPT Eduteck quality-assurance scripts processed students' personal information through Google Gemini. CBSE said the vulnerabilities had been contained.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
The third-party vendor processed sensitive student data using a US-based AI service without student consent, violating data privacy laws and demonstrating a failure of governance.
The incident involved the unauthorized processing of non-public sensitive student data and answer sheets by Google Gemini without student consent, violating data privacy and sovereignty.
Human
Due to a decision or action made by humans
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The privacy risk was caused by human developers intentionally integrating Google Gemini into automation scripts, leading to the unexpected exposure and unauthorized transfer of sensitive student data.
An ethical hacker exposed vulnerabilities in India's CBSE digital evaluation system, revealing that a third-party vendor used Google Gemini scripts to process sensitive student data, sending it to US servers without consent. While the technical flaws have been contained, the incident highlights critical data sovereignty and third-party AI integration risks for government entities.
The report describes Google Gemini being used within automation scripts prepared by quality assurance engineers to process student data. In this context, the AI functioned as a Tool, performing specific, automated data processing tasks based on direct inputs from the scripts.
High Risk: The AI was used in CBSE's digital evaluation ecosystem to process student exam data and answer sheets. This falls under Risk Level 2 as it involves 'Educational and vocational training systems' that affect student grading and academic outcomes.
The AI was integrated into automation scripts by quality assurance engineers to process student exam data and answer sheets, which is part of CBSE's digital evaluation and marking ecosystem.
The report provides clear, direct statements from the ethical hacker who discovered the vulnerability, along with official statements from the CBSE acknowledging the security flaws. The role of Google Gemini in the automation scripts is explicitly described, leaving little ambiguity about the nature of the privacy and security issues.
One could argue this is primarily an IT security incident rather than an AI safety incident, but the integration of Gemini to process sensitive student data without consent directly links it to AI data governance risks.
Technology
Unsecured Public AWS Buckets
Answer sheets stored in public AWS buckets without authentication.
Weak Password Security
The passwords used across the portal were easy to guess.
Vulnerable Portal Architecture
Active, exploitable vulnerabilities left open in the OnMark portal.
Data Inputs
Unprotected Sensitive Student Data
9.3 million rows of sensitive student data were left unprotected.
Raw Student Data in QA Scripts
Personal student data fed directly into Gemini automation scripts.
Human Factors
Weak Password Selection
Users/admins set easy-to-guess passwords on the ecosystem.
QA Engineers Sending Data to Gemini
Engineers used Gemini to process sensitive student data in scripts.
Process and Methods
Inadequate Vulnerability Patching
CBSE did not respond to or patch active vulnerabilities for months.
Insecure Data Storage Practices
Vendor stored answer sheets on public AWS buckets to save cost.
Lack of AI Data Privacy Controls
No checks before sending sensitive student data to Gemini in the US.
Management
Poor Vendor Oversight
CBSE did not monitor COEMPT Eduteck's insecure cloud and AI usage.
Delayed Incident Response
CBSE initially rejected claims and ignored follow-up reports.
Inadequate Infrastructure Management
CBSE poorly managed its IT infrastructure and security safeguards.
Regulatory Environment
Data Sovereignty Violations
Student data was sent to the US for processing, violating local laws.
Lack of Consent for Data Processing
Third-party AI processed student exam data without student consent.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
