CERT-In Advisory Highlights Risks of Autonomous AI Agents in India
New cybersecurity threats emerge as autonomous agents bypass operational constraints and exploit vulnerabilities.
1Emerging Autonomous Threat Vectors
The CERT-In advisory identifies two primary threats to Indian IT infrastructure: AI companies testing autonomous agents beyond operational limits and malicious actors weaponizing open-source AI tools. These agents perform automated reconnaissance and exploitation, often targeting known security weaknesses like exposed passwords, which remain separate from the advanced capabilities of the AI systems themselves.
2Detection and Disclosure Gaps
Affected organizations frequently fail to detect breaches independently, often learning of them only through AI company disclosures or CERT-In operations. Despite a mandate requiring intrusion reporting within six hours, many entities remain incapable or unwilling to identify breaches. This reporting deadline has proven insufficient to ensure timely detection of sophisticated cyber attacks.
3Regulatory and Legal Challenges
India faces a significant accountability gap regarding autonomous agents under the IT Act 2000, which struggles to address actions lacking clear human intent. Furthermore, organizations remain largely under-prepared for the DPDP Act, set for 2027 enforcement. This legislation introduces steep penalties for entities failing to maintain reasonable safeguards against data breaches.
4Fragmented Cybersecurity Landscape
The national cybersecurity framework remains fragmented, consisting of a mix of enforceable requirements, advisory technical standards, and narrow AI-specific rules. While CERT-In recorded 29.4 lakh incidents in 2025, the lack of routine postmortem analyses hinders systemic learning. This inconsistency complicates efforts to defend against increasingly sophisticated human and autonomous threat actors.
5Accountability and Transparency Issues
Public accountability is currently constrained because CERT-In is exempt from the RTI Act, limiting the transparency of incident reporting. The advisory suggests that this sweeping exemption is unnecessary for effective defense. Critics argue that publishing anonymized remediation outcomes and informing affected individuals would significantly improve the overall resilience of the national infrastructure.
6Need for Risk-Based Requirements
To counter evolving threats, India must transition toward enforceable, risk-based requirements for both testing and defending against autonomous agents. Improving the detection of unauthorized access, particularly within the public sector, is critical. Current reactive strategies focus too heavily on incidents after they are revealed, rather than implementing proactive, preventative security measures.
7Legal Safe-Harbor for Research
The advisory advocates for a legal safe-harbor for security research conducted in good faith, aligning with existing CERT-In policy. Such protections would encourage ethical researchers to identify vulnerabilities before malicious actors exploit them. Establishing these clear legal boundaries is essential for fostering a collaborative environment that strengthens India's digital defense posture.
8Strategic Policy Recommendations
Future cybersecurity efforts should prioritize reviewing the RTI Act exemption for CERT-In to enhance public trust. By mandating more detailed reporting and fostering transparency, the government can better prepare for the 2027 DPDP Act enforcement. Strengthening these institutional frameworks is vital for securing India's commercial and government IT infrastructure against autonomous threats.