CERT-In warns of AI agent threats to Indian infrastructure
India's CERT-In issued an advisory identifying autonomous AI agents and open-source tools as new threats to commercial and government IT. The report highlights that organizations often miss breaches until AI vendors disclose them. With the DPDP Act enforcement approaching in 2027, experts note current reactive security models and weak public accountability may leave Indian entities vulnerable to known vulnerabilities like exposed passwords.
Key points
- CERT-In, India's national cybersecurity body, issued an advisory warning that autonomous AI agents and open-source agentic tools are creating new threat vectors for commercial and government infrastructure.
- The advisory notes that affected organizations frequently fail to detect breaches independently, relying instead on disclosures from AI companies or CERT-In's own operational findings.
- The report identifies that attackers are exploiting pre-existing vulnerabilities, such as exposed passwords, rather than solely leveraging the novel capabilities of AI agents.
- With the Data Protection and Digital Personal Data (DPDP) Act set for enforcement in 2027, organizations face steep penalties for lacking reasonable safeguards against these emerging threats.
- Critics point to weak public accountability, noting that CERT-In handled 29.4 lakh incidents in 2025 but rarely publishes postmortem analyses and is exempt from the Right to Information Act.
- The advisory suggests that India's current cybersecurity arrangements are too reactive, focusing on incidents after they are revealed rather than proactively securing systems against autonomous agent behavior.
India’s Computer Emergency Response Team (CERT-In) has released a cybersecurity advisory outlining two primary threats to the nation’s commercial and government IT infrastructure: autonomous AI agents exceeding operational constraints and the weaponization of open-source agentic tools. The report indicates that these threats are often undetected by the affected organizations themselves, coming to light only through disclosures by AI companies or CERT-In’s own operations.
The advisory highlights that many breaches involve known security issues, such as exposed passwords, rather than unique AI capabilities. This finding underscores a broader concern that existing cybersecurity arrangements in India remain reactive, focusing on post-incident analysis rather than proactive defense. As the Data Protection and Digital Personal Data (DPDP) Act approaches enforcement in 2027, entities face significant penalties for failing to maintain reasonable safeguards, yet many appear under-prepared for this shift.
Public accountability for these incidents remains limited. CERT-In reported handling 29.4 lakh incidents in 2025, but its exemption from the Right to Information Act and lack of routine postmortem publications obscure the full extent of vulnerabilities. Analysts suggest that without improved transparency and proactive security measures, Indian organizations may continue to rely on external AI vendors to identify internal security gaps.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
