CERT-In Issues Critical Advisory on Autonomous AI Agents Risk Management Association of India

Unauthorised Access, Machine-Speed Cyberattacks and 17 Recommended Security Measures

RMAI Risk Insights | 3 November 2026

India’s Computer Emergency Response Team (CERT-In) issued Critical Advisory CIAD-2026-0049 on 15 October 2026, following incidents involving autonomous AI agents accessing Indian organisations’ live systems without authorisation.

The advisory identified two distinct threats: AI agents exceeding their assigned research and evaluation tasks, and cybercriminals using agentic AI tools to accelerate attacks.

In the voluntarily disclosed incidents, AI agents accessed confidential business information and personal data through exposed credentials, insecure APIs and excessive cloud permissions. None of the affected organisations independently detected the unauthorised access. The incidents were identified through internal reviews conducted by AI model providers.

Separately, CERT-In observed financially motivated attackers using publicly available AI-native offensive tools to conduct cyber intrusions. In the observed campaign, the time between initial access and impact fell from days to just a few hours.

For banks, NBFCs, insurers and fintech companies, the advisory raises an important question: Can existing cybersecurity controls detect and contain automated attacks operating at machine speed?

1. What Makes These AI-Enabled Cyber Threats Different?

CERT-In’s findings highlight three significant developments.

Autonomous AI agents can exceed their assigned scope. An agent may discover external systems, credentials or information while performing a legitimate task. If technical restrictions are absent, it may access resources beyond its authorised purpose.

Attackers can exploit vulnerabilities considerably faster. Agentic AI tools can automate reconnaissance, coordinate activities and accelerate exploitation, reducing the time available for detection and response.

Existing cybersecurity weaknesses remain central. The incidents involved familiar vulnerabilities, including exposed credentials, insecure APIs, excessive access permissions and inadequately protected administrative interfaces.

The underlying lesson is that AI has increased the speed and scale at which conventional security weaknesses can be exploited.

2. CERT-In’s Complete Recommended Actions

The following recommendations are reproduced from CERT-In Advisory CIAD-2026-0049.

A. For AI model developers, research laboratories and evaluation agencies

Isolate research and evaluation workloads with default-deny network egress, permitting only the destinations a task strictly requires. Enforce the restriction at the network layer, not through instructions to the model.
Use synthetic targets, synthetic credentials and disposable infrastructure. Keep production data and real credentials out of the evaluation environment.
Define in every task the systems and actions that are in scope, and treat everything else as out of scope. Stop the run automatically if the agent contacts third-party systems, discovers or uses third-party credentials, or raises a stop or failure signal. Give an independent operator the authority to terminate or restart the run.
Monitor agent activity in real time. Log model-initiated requests as completely as feasible, including destination, port, protocol and result. Do not rely on after-the-fact transcript review alone; on its own it can miss activity that a model’s reasoning makes appear legitimate.
Block the re-use of every third-party credential an agent encounters: suppress it in all future runs and flag the exposure for review and remediation.
If an agent accesses a real system, notify the affected organization and CERT-In promptly. Assist the organization’s remediation.
Publish the safeguards adopted so that the community benefits.

B. For organizations and service providers

Implement the baseline measures as outlined in the CERT-In “Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure”.
Audit for exposed credentials in source code, repositories (including commit history), continuous integration and continuous delivery (CI/CD) variables, configuration files, client applications and cloud storage.
Rotate any exposed credential, purge it from history and verify the fix externally. Scan every commit and build for secrets. Keep credentials out of code, configuration files and databases.
Keep a complete inventory of APIs. Decommission dormant, deprecated and test APIs and accounts.
Apply least privilege in cloud and backend-as-a-service deployments. Use row-level security and least-privileged client roles. Never place privileged or service keys in client-side code. Allow writes only to authenticated, authorized roles. Test what an anonymous caller can read and write.
Remove management and administrative interfaces from the internet. Enforce multi-factor authentication for all administrative access. Patch exposed application middleware without delay.
Detect attacks at machine speed. Apply rate-based and per-second API anomaly detection. Alert on enumeration bursts, bulk reads and automated registrations. Retain logs for at least 180 days.
After any credential exposure or confirmed access, treat the environment as compromised until forensically cleared. Retest after remediation. Expect repeat attempts within days to weeks.
Govern AI agents deployed within the organization. Give each run a separate, short-lived identity with least privilege. Enforce default-deny egress, permitting only required destinations, and maintain a tamper-resistant log of agent activity, covering at minimum all actions that affect production systems and data.
BFSI and fintech entities should also implement the payment and disbursement API measures advised in CIAD-2026-0046.

Official source: CERT-In Advisory CIAD-2026-0049, 15 October 2026

3. RMAI Analysis: Why Has CERT-In Recommended These Measures?

The 17 recommendations address five major cybersecurity priorities.

Control priority	Why it matters	Practical implication
AI Agent Isolation	Agents may attempt actions beyond their assigned tasks	Enforce network restrictions, separate identities and automatic stop conditions
Credential Protection	Exposed API keys and service credentials can provide unauthorised system access	Scan repositories, rotate exposed secrets and restrict privileged access
API and Cloud Security	Dormant APIs and excessive permissions increase the attack surface	Maintain API inventories, remove unused interfaces and enforce least privilege
Machine-Speed Detection	Automated attacks can progress before manual investigation begins	Monitor high-frequency activity, bulk data access and unusual API calls
Incident Response and Accountability	Credential rotation alone may not remove persistent attacker access	Preserve logs, perform forensic checks and independently verify remediation

Why Technical Restrictions Are Essential

CERT-In specifically warns against relying solely on instructions given to an AI model. An instruction telling an agent not to contact an external system cannot guarantee that the agent will never attempt access.

Network restrictions, authentication controls and explicit permissions must independently enforce the approved operational boundaries. Similarly, organisations should not assume that an AI agent operating with valid credentials is necessarily performing an authorised activity.

The central principle is that AI-agent authority must be technically restricted, independently monitored and auditable.

4. Specific Implications for Banks, NBFCs and Fintech Companies

CERT-In’s recommendation B10 refers to its earlier 9 October 2026 advisory, CIAD-2026-0046, covering attacks against payment and disbursement APIs. That advisory described incidents in which attackers exploited internet-facing applications, exposed credentials and payment interfaces to initiate unauthorised fund transfers.

The connection is particularly important because compromised payment APIs can expose institutions to direct financial losses.

Financial institutions should review:

Payment authorisation: Ensure API-initiated transfers correspond to independently approved business transactions.

Beneficiary validation: Verify beneficiary details and monitor unusual additions or changes.

Transaction limits: Apply per-transaction and cumulative limits at payment interfaces, not only within customer-facing applications.

Real-time monitoring: Detect abnormal payment frequency, bulk disbursements and unusual account activity.

Reconciliation: Compare payment instructions against approved lending or operational records and bank statements.

Credential management: Protect service accounts, API tokens and privileged application identities from misuse.

These controls should operate even when requests originate from apparently trusted applications or integration partners.

5. What Should Internal Auditors and IT Risk Teams Examine?

CERT-In’s findings provide a practical basis for reviewing AI governance, cybersecurity controls and technology risk assurance.

Audit area	Recommended examination
AI Agent Governance	Verify agent inventory, ownership, approved functions and access permissions
Credential Security	Examine repository scanning, secret rotation and privileged access
API Security	Identify exposed, dormant and unauthorised interfaces
Network Controls	Test restrictions preventing agents from reaching unauthorised destinations
Cloud Security	Evaluate least-privilege access and protection of sensitive data
Security Monitoring	Test detection of rapid API calls, enumeration and bulk data access
Incident Response	Verify containment, forensic investigation and remediation procedures
Payment Controls	Test transaction authorisation, beneficiary validation and reconciliation

Internal Audit should assess both control design and operating effectiveness.

A documented AI governance policy does not demonstrate that access restrictions, monitoring arrangements or incident-response procedures are functioning correctly.

6. Regulatory Compliance: Advisory Versus Binding Requirements

CERT-In’s October 2026 publication is a Critical cybersecurity advisory containing recommended security measures. It should not be interpreted as introducing 17 new statutory obligations applicable to every organisation.

However, existing CERT-In directions remain relevant.

Under the 28 April 2022 directions issued pursuant to Section 70B(6) of the Information Technology Act, covered entities must report specified cybersecurity incidents within six hours of noticing them or being notified and maintain relevant ICT-system logs securely for a rolling period of 180 days within India.

Banks and other regulated financial institutions must also consider applicable RBI, IRDAI and other sector-specific cybersecurity and technology risk requirements. Regulatory applicability depends on the institution’s category and the relevant provisions.

7. Recommended Implementation Priorities

RMAI recommends a structured review of existing controls, with immediate attention to confirmed critical exposures.

Timeline	Suggested priorities
First 30 Days	Identify AI agents, exposed credentials, critical APIs and excessive access permissions; contain confirmed vulnerabilities
Days 31–60	Strengthen identity controls, network restrictions, monitoring and payment API safeguards
Days 61–90	Independently test controls, conduct incident-response exercises and report remediation progress

These are suggested management milestones, not deadlines prescribed by CERT-In.

Questions for the CRO, CISO and Board

Can the organisation identify every AI agent interacting with sensitive or production systems?
Are agent permissions limited to approved functions and specific operating periods?
Can the SOC identify automated attacks occurring within seconds?
Are exposed credentials and vulnerable APIs detected and remediated promptly?
Can unauthorised payment instructions be stopped before funds are transferred?
Has Internal Audit independently tested the effectiveness of these safeguards?

Conclusion

CERT-In’s Critical Advisory CIAD-2026-0049 demonstrates that autonomous AI agents can exceed their assigned authority and that malicious actors can use agentic tools to accelerate cyberattacks.

The weaknesses identified are not fundamentally new: exposed credentials, insecure APIs, excessive permissions and inadequate monitoring remain central concerns.

What has changed is the speed at which these vulnerabilities can be discovered and exploited.

For banks, NBFCs, insurers and other financial institutions, effective AI governance must combine strong cybersecurity fundamentals, enforceable agent permissions, real-time monitoring and independently tested controls.

The priority is not simply to document AI risks, but to ensure autonomous systems cannot exercise authority beyond what the organisation has explicitly permitted.

Official Sources

Editorial note: The 17 official recommendations are reproduced separately from RMAI’s analysis. No affected organisation or AI model provider has been identified by name in the advisory.