CERT-In lays out security norms for Agentic AI systems, Pg16

Key Highlights:

• The Indian Computer Emergency Response Team (CERT-In) has released specific security and auditing guidelines for Agentic AI systems.
• The guidelines, titled Artificial Intelligence (AI) Security Auditing Guidelines, address AI systems capable of independent planning, task execution, and delegation.
• CERT-In identified features such as autonomous task execution, persistent memory, and task delegation as factors increasing risks in these AI systems.
• The framework mandates testing for unauthorized actions, misuse of tools, and the effectiveness of emergency-stop mechanisms in Agentic AI.

CERT-In.jpg

Detailed Insights:

• Agentic AI systems are distinct from conventional AI as they can take multiple steps, access external information, and delegate tasks to achieve objectives.
• The guidelines aim to ensure the secure, ethical, and auditable deployment of advanced AI technologies within India's digital ecosystem.
• Specific security concerns highlighted include an AI agent exceeding its authorized permissions or misusing credentials.
• Auditors are required to examine the safety of task delegation and the efficacy of emergency-stop mechanisms within these AI systems.
• The framework also addresses risks associated with an agent's persistent memory and the information it retains from prior interactions.
• CERT-In functions under the Ministry of Electronics and Information Technology (MeitY), serving as India's national agency for cybersecurity incident response.

Scientific/Technical Concepts Involved:

• Agentic AI: Advanced AI systems that can autonomously plan, execute, and delegate tasks, often interacting with external tools and systems.
• Persistent Memory: The ability of an AI system to retain and utilize information from past interactions or tasks over extended periods.
• Cybersecurity Auditing: A systematic process of evaluating an organization's information system security controls to ensure compliance and effectiveness.