Speaking at the NDTV World Summit on 23 October 2026, Malhotra stated that the RBI, the government and banking institutions were aware of the growing risks posed by AI-powered cyber threats and were taking preventive measures to strengthen their security frameworks.
The Governor referred to reports of AI agents allegedly targeting overseas banking systems and accessing sensitive information. Such developments have raised concerns about the growing sophistication of cyberattacks, particularly as autonomous AI tools become capable of performing complex activities with limited human intervention.
Reports involving major US financial institutions have also highlighted concerns about third-party AI agents accessing customer accounts and potentially performing activities beyond the instructions or authorisation provided by account holders.
Malhotra acknowledged that these risks were significant but maintained that financial institutions could address them through robust cybersecurity controls, continuous monitoring and timely remediation of vulnerabilities.
RBI Strengthens Supervision of Banking Technology Systems
The RBI Governor highlighted the central bank’s established regulatory and supervisory mechanisms for monitoring cybersecurity and technology-related risks across banks and non-banking financial companies (NBFCs).
He explained that the central bank has specialised teams and technical experts who conduct audits and assessments of IT systems at major financial institutions. These supervisory activities are intended to identify weaknesses, evaluate compliance with regulatory requirements and improve the resilience of critical banking infrastructure.
The RBI also maintains regular communication with banks and NBFCs to strengthen technology governance and ensure that institutions implement appropriate safeguards.
According to Malhotra, cybersecurity supervision focuses particularly on two areas: protecting sensitive financial and customer data, and preventing cyberattacks that could disrupt banking operations or cause system downtime.
He further observed that the rapid pace of technological development can introduce new vulnerabilities into banking systems. Consequently, identifying weaknesses early and deploying appropriate security patches remain essential elements of effective cyber-risk management.
Recent Cybersecurity Concerns Highlight Banking Sector Vulnerabilities
The Governor’s comments follow reports concerning a suspected exposure of 3,897 customer records associated with the State Bank of India (SBI). The records, reportedly containing personally identifiable information, were suspected to have appeared on the dark web.
The incident has brought renewed attention to the importance of customer data protection, information security governance and continuous cybersecurity monitoring across financial institutions.
Although the reported SBI exposure and the emerging concerns surrounding autonomous AI agents are separate developments, both highlight the expanding range of cyber and technology risks confronting the banking sector.
Financial institutions increasingly depend on interconnected digital platforms, application programming interfaces, cloud infrastructure and external technology providers. These dependencies can create additional vulnerabilities if access controls, third-party oversight and incident-response arrangements are inadequate.
AI-Driven Cyber Risks Create New Governance Challenges
Artificial intelligence is transforming financial services by enabling automated decision-making, fraud monitoring, customer support and operational efficiency. However, the same technology can also be exploited by malicious actors to conduct sophisticated cyberattacks.
AI-enabled threats may involve automated vulnerability discovery, advanced phishing campaigns, credential compromise, unauthorised account access and attacks against interconnected financial systems.
These developments are particularly relevant for banks and NBFCs because cyber incidents can lead to financial losses, operational disruptions, regulatory consequences and reputational damage.
Earlier in October 2026, the RBI Governor had also identified AI-related cybersecurity threats, model risk, third-party dependencies and reduced human oversight as emerging financial stability concerns. The central bank has strengthened its technology and cyber-risk governance framework through its 2026 directions for commercial banks, covering board oversight, CISO responsibilities, access controls, third-party arrangements and incident response.
Implications for Banks, CISOs and Risk Management Professionals
The Governor’s observations reinforce the importance of integrating AI-related threats into enterprise-wide cybersecurity and operational risk management frameworks.
For Chief Information Security Officers (CISOs), Chief Risk Officers (CROs), compliance professionals and technology governance teams, the developments highlight several priorities, including stronger identity and access management, security assessment of third-party AI applications, continuous vulnerability monitoring, automated threat detection and comprehensive incident-response preparedness.
Financial institutions also need to evaluate whether existing security controls are capable of detecting malicious activities carried out at the speed and scale enabled by AI.
From a governance perspective, boards and senior management must ensure that the adoption of AI technologies is accompanied by proportionate security controls, clear accountability arrangements and effective oversight of external technology providers.
The RBI Governor’s remarks underline a broader shift in banking risk management: cybersecurity is no longer solely an IT function but an essential component of operational resilience, customer protection and financial stability.
As AI adoption accelerates across the financial sector, maintaining secure, resilient and continuously monitored banking systems will remain critical to preserving customer confidence and ensuring uninterrupted financial services.
