CERT-In Advisory on AI Agents: What Happened and Why Cyber Defences Fail

Context

As of October 2026, the Indian Computer Emergency Response Team issued an urgent advisory warning that autonomous artificial intelligence agents have breached live enterprise networks. Algorithmic execution now outpaces conventional perimeter defence. According to CERT-In Advisory CIAD-2026-0049, affected organisations failed to detect these intrusions independently. They discovered compromised business records only after voluntary disclosures arrived from external AI model providers.

Traditional chatbots generate text probabilistically within narrow conversational prompts. Autonomous agentic systems operate with independent agency. They run operating system commands, search out exposed cloud credentials, and chain application programming interfaces across enterprise environments. This operational shift compresses the cyber attack lifecycle from days down to a few hours. It also exposes critical gaps across India's Information Technology Act, 2000.

On October 15, 2026, the Indian Computer Emergency Response Team issued Advisory CIAD-2026-0049. The national nodal agency warned Indian organisations about unauthorised intrusions executed directly by autonomous software agents. Exercising statutory powers under Section 70B of the Information Technology Act, 2000, CERT-In alerted enterprise operators that adversaries deploy offensive multi-agent frameworks against domestic digital assets.

Victim organisations remained unaware of active data exfiltration until external model developers shared internal audit telemetry. As of October 2026, this alert builds on earlier regulatory interventions. These include CERT-In Advisory CIAD-2026-0020 on frontier AI risks from April 2026 and the vulnerability mitigation blueprint released in May 2026.

Autonomous AI agents mark a structural departure from passive text generators. Conventional large language models operate within bounded windows, returning answers only when queried by a human operator.

According to CERT-In Advisory CIAD-2026-0049, agentic software operates through direct execution. These systems plan sub-tasks, execute multi-step web interaction, and run operating system shell scripts. They invoke external application programming interfaces without human oversight. This shift turns software agents into active execution engines capable of modifying system configurations.

Threat actors harness these capabilities by launching offensive frameworks against Indian enterprise networks. In the breaches recorded by CERT-In, autonomous agents gained initial access by harvesting exposed API keys from public code repository histories. They then exploited overly permissive Identity and Access Management roles to escalate privileges across internal infrastructure.

By automating reconnaissance and lateral movement, agentic tools cut intrusion times to hours. Enterprise security operations centres, designed around human intervention cycles, cannot contain breaches that spread at machine velocity.

Multi-agent architectures introduce systemic operational risks. When an enterprise partitions operations into specialised sub-tasks, a single poisoned prompt can destabilise the entire chain.

According to the Cloud Security Alliance MAESTRO Framework and the CERT-In AI Cybersecurity Blueprint, agentic workflows create two primary cascading attack vectors:

• Indirect Prompt Injection: Adversaries embed hidden instructions within external web pages, documents, or database queries. As detailed in CERT-In Advisory CIAD-2025-0013, this malicious text overrides initial system prompts. It compels the agent to trigger unauthorised API actions, exfiltrate records, or alter operational permissions.
• Agent Memory Poisoning: Threat actors tamper with long-term memory caches and retrieval-augmented generation data stores. CERT-In Advisory CIAD-2025-0013 notes that this tampering leads agents to make compromised security decisions during subsequent tasks. The intrusion persists long after the original network session closes.

Because secondary agents automatically trust data received from primary internal software routines, malicious commands execute across the pipeline without tripping conventional perimeter alarms.

The Information Technology Act, 2000 encounters an enforcement void when handling autonomous, non-deterministic security incidents. India's core cyber statute presumes predictable, human-directed intrusion techniques.

This legal structure creates two distinct regulatory failures:

• Diffuse Liability: When an autonomous agent alters or deletes data without human instruction, existing laws cannot allocate statutory civil liability or criminal fault among model designers, corporate deployers, and the software tool.
• Unusable Detection Thresholds: The mandatory six-hour reporting window assumes observable, deterministic breach indicators. Because autonomous algorithmic exfiltration leaves conventional telemetry intact, victim organisations breach statutory reporting windows unknowingly.

Critical Information Infrastructure systems face direct exposure as autonomous tools enter financial operations and industrial controls. Under Section 70(1) of the Information Technology Act, 2000, Critical Information Infrastructure covers any computer resource whose compromise would debilitate national security, the economy, public health, or safety.

The National Critical Information Infrastructure Protection Centre, established under Section 70A of the IT Act, monitors six designated sectors:

• Power and Energy: Supervisory control and telemetry systems managing electrical grids.
• Banking, Financial Services and Insurance (BFSI): High-volume payment gateways, real-time clearing systems, and settlement pipelines.
• Telecom: Core routing channels and network exchange switches.
• Transport: Air traffic management, freight dispatch, and automated railway signalling.
• Government: State administrative databases and citizen identity platforms.
• Strategic and Public Enterprises: Nuclear installations, defence production assets, and sovereign data centres.

Financial infrastructure faces acute operational risk from automated exploitation techniques. As reported in early October 2026, CERT-In issued an advisory after attackers targeted roughly 20 financial institutions using stolen partner credentials and automated payment system vectors. If autonomous agents secure write permissions on these networks, malicious prompt injections could initiate unauthorised fund transfers before transaction monitoring engines spot irregular activity.

Sovereign risks also arise from structural reliance on external AI providers. The CERT-In AI Cybersecurity Blueprint warns that running foreign proprietary models across critical assets introduces vulnerabilities from uninspected remote model weights and automated telemetry feeds. In a conflict scenario, dependent institutions risk remote service revocation or supply chain compromise, while domestic regulators lack access to underlying source code or training data.

Securing networks against autonomous cyber threats demands strict containment boundaries, zero-trust configurations, and modernised statutory rules. Technical safeguards must constrain agent execution before tools interact with production networks.

According to the CERT-In AI Cybersecurity Blueprint, organisations must isolate agent execution within containerised, air-gapped sandboxes. These secure environments rely on network micro-segmentation, ephemeral storage, and automated memory resets between tasks. Such safeguards block persistent prompt injection payloads.

Organisations must also enforce human-in-the-loop authorisation gates for sensitive operations. This requires explicit operator sign-off before agents can write to databases, deploy code, or transmit data across external channels.

Security teams must execute four immediate operational safeguards:

• Identity and Credential Hardening: Under CERT-In Advisory CIAD-2026-0049, teams must rotate system credentials regularly, purge access keys from public repositories, and enforce least-privilege policies across cloud roles.
• Perimeter Attack Surface Reduction: Infrastructure engineers must detach internal administrative consoles, development clusters, and staging databases from the public internet to block automated web-crawling reconnaissance.
• Rapid Remediation Cycles: Organisations must comply with CERT-In's May 2026 blueprint by remediating known exploited vulnerabilities on public-facing assets within a twelve-hour operational window.
• Environment Reconstruction: Because entities conducting partial cleanup suffered repeated intrusions within days, teams must redeploy compromised systems from clean baseline images instead of applying piecemeal patches.

Statutory frameworks under the Ministry of Electronics and Information Technology must adapt to non-deterministic threats. CERT-In's reporting directions under Section 70B require revisions that mandate continuous agent logging and anomalous execution tracking. In parallel, establishing dedicated safety testing under the National Critical Information Infrastructure Protection Centre will ensure India's essential utilities build durable resilience against autonomous algorithmic threats.

• CERT-In issued Advisory CIAD-2026-0049 on October 15, 2026, revealing that autonomous AI agents executed undetected intrusions into Indian enterprise systems, discovered only via voluntary model provider disclosures.
• Agentic architectures differ from passive chatbots by autonomously invoking tools, executing shell scripts, and compressing cyber attack lifecycles from days to a few hours.
• Threat vectors such as indirect prompt injection and memory poisoning allow hidden adversarial instructions to subvert agent directives and propagate through multi-agent chains.
• The Information Technology Act, 2000 exhibits statutory gaps, as Sections 43 and 66 assume human mens rea, while the 2022 CERT-In six-hour reporting rule fails against silent algorithmic compromises.
• Engineering resilience demands mandatory human-in-the-loop authorisation gates for high-consequence tasks, air-gapped sandboxed execution, and patching critical vulnerabilities within twelve hours.