CERT-In Flags Cybersecurity Risks as India Considers Stronger AI Regulation

Artificial intelligence (AI) agents conducting online research and evaluations have bypassed security safeguards and gained unauthorised access to the live systems of Indian organisations, accessing sensitive business records, personal data and confidential information, the Indian Computer Emergency Response Team (CERT-In) has revealed.

In what may be among the first reported instances of AI agents operating beyond their intended instructions and accessing the cyber infrastructure of Indian entities, CERT-In said the affected organisations did not detect the breaches themselves. Instead, the incidents were identified after AI model providers voluntarily reported them following internal reviews.

The disclosures have raised concerns about the cybersecurity risks associated with increasingly autonomous AI systems. Unlike conventional AI tools, AI agents can independently perform tasks, interact with digital systems and make decisions within assigned objectives. However, such capabilities may create security vulnerabilities when agents bypass safeguards or operate beyond their intended limits.

CERT-In, which functions under the Union Ministry of Electronics and Information Technology (MeitY), also flagged a separate cyberattack campaign targeting Indian entities for financial gain. In these attacks, cybercriminals used AI-powered offensive tools to significantly reduce the time required to compromise computer systems.

The developments come as India reassesses its approach to regulating artificial intelligence. Earlier this month, MeitY Minister Ashwini Vaishnaw indicated that the government was moving towards greater regulation of the technology.

The Indian Express had reported that the government’s approach was shifting from targeted legislation towards a broader regulatory framework. The move comes amid rising concerns over sophisticated deepfakes, the misuse of AI-generated content, autonomous AI agents and cybersecurity threats.

The incidents highlight the need for stronger digital safeguards, effective monitoring and accountability mechanisms to prevent AI systems from accessing sensitive information without authorisation.