“What concerns CERT-In most at present is delegated authority without commensurate guardrails and that AI agents are being trusted faster than they are being secured,” Dr Sanjay Bahl, Director General of the Indian Computer Emergency Response Team (CERT-In), told MediaNama.

In written answers to MediaNama’s questions, Bahl said CERT-In has seen two kinds of incidents involving AI agents. In one, agents under research and evaluation accessed live systems without authorisation; in the other, cybercriminals used publicly available agentic frameworks to compress “the time from initial access to impact from days to just a few hours”.

According to Bahl an agent that misuses credentials or acts beyond its assigned scope has caused a cybersecurity incident, reportable to CERT-In within six hours under its 2022 directions.

The CERT-In chief also said that “fewer organisations are at present capturing the complete, structured record of its tool calls and actions in a form that can be produced during an investigation”.

MediaNama sent the questions as part of its research for a forthcoming report. Bahl’s answers, sent on November 2 and 3, are reproduced below as he sent them, with links added to the CERT-In documents he cites.

The questions in brief for reference:

1. The picture today

  • When CERT-In thinks about AI agents, meaning software that acts on a person’s or an organisation’s behalf with access to their email, files, browser or payments, what concerns it most at present? Are agents beginning to appear in the incidents reported to CERT-In, either as the target of an attack or as the cause of harm, and could you describe, without naming anyone, the kind of cases you are seeing?

2. How agents are attacked:

    • A recurring weakness is prompt injection: instructions hidden in a web page, email or document that an agent reads and then follows. How serious is this for Indian users and organisations, and what should those deploying agents do about it, given that developers themselves say it may never be fully solved?
    • Agents are often extended with skills, plug-ins and connectors from public marketplaces, some of which have been found to carry malware, and some agent installations have been found exposed on the Internet. Does CERT-In track these risks in India, and what has it found?
    • Many people now give an agent their passwords, card details or full inbox access because there is no narrower way to delegate. From a security standpoint, what should replace this, and who in India would need to build it?

    3. Reporting and investigation

    • Under the April 2022 directions, incidents must be reported within six hours. If an agent is tricked into misusing its user’s credentials, or acts beyond what the user asked without any breach, is that a reportable incident? Who in the chain should report it: the agent’s developer, the organisation deploying it, or the platform on which it acted?
    • If CERT-In were investigating an incident involving an agent, which records would it need, for instance the instructions the agent received, the tools it used and the actions it took? Are organisations keeping such records today?
    • CERT-In’s July 2025 technical guidelines include an AI bill of materials. An agent’s components change often: its model can be swapped, new skills added, and its memory grows. How should a bill of materials work for a system that changes in this way?

    4. Looking ahead

    • If more than half of the traffic on the Internet came from AI agents, how would that change the way CERT-In approaches attacks, monitoring and incident response? What would India need to have in place before that happens?
    • One proposal is that agents identify themselves in proportion to risk: declaring that they are agents when browsing, carrying a delegated token when logged in, and requiring fresh human authentication for payments or government applications. From an incident-response perspective, would this help, and what should such an identity contain?
    • What would be a useful first step from CERT-In on agents in the coming year, for instance guidance for organisations deploying them, or a channel to receive and share reports of agent incidents?

    Interview:

    1. The picture today

    MediaNama: When CERT-In thinks about AI agents, meaning software that acts on a person’s or an organisation’s behalf with access to their email, files, browser or payments, what concerns it most at present? Are agents beginning to appear in the incidents reported to CERT-In, either as the target of an attack or as the cause of harm, and could you describe, without naming anyone, the kind of cases you are seeing?

    Dr Sanjay Bahl: What concerns CERT-In most at present is delegated authority without commensurate guardrails and that AI agents are being trusted faster than they are being secured.

    CERT-In has observed two distinct categories of cyber incidents involving AI agents and agentic frameworks, as highlighted in the advisory CIAD-2026-0049, issued on October 15, 2026.

    The two patterns seen are:

    a) AI agents acting beyond their assigned tasks during research and evaluation activities. Without authorisation the agents accessed live systems. These agents identified and used exposed credentials, application configuration details and overly permissive cloud access controls to access business records, including personal information.

    b) The second pattern involves the deliberate misuse of publicly available agentic AI frameworks by cybercriminals. CERT-In has observed financially motivated cyberattack campaigns in which threat actors used such frameworks compressing the time from initial access to impact from days to just a few hours. CERT-In has also observed that these frameworks are not only misused but also rebranded, with numerous deployments identified across infrastructure in multiple countries.

    2. How agents are attacked

    MediaNama: A recurring weakness is prompt injection: instructions hidden in a web page, email or document that an agent reads and then follows. How serious is this for Indian users and organisations, and what should those deploying agents do about it, given that developers themselves say it may never be fully solved?

    Dr Sanjay Bahl:

    Prompt injection is a serious cybersecurity concern, particularly as AI agents are increasingly being connected to an organisation’s applications, sensitive information and external services. Malicious instructions embedded in websites, emails or documents can potentially influence an agent’s behaviour and cause it to perform unintended or unauthorised actions.

    CERT-In has highlighted this risk in its advisory CIAD-2025-0013, issued in March 2025, which addresses security vulnerabilities associated with generative AI applications, including prompt injection.

    This concern has also been covered in CERT-In’s Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure, issued in May 2026. The Blueprint recommends measures such as validation of external inputs, restricting AI system permissions, adversarial testing and continuous monitoring.

    While prompt injection may not be completely eliminated through safeguards built into AI models, the associated risks can be reduced considerably through appropriate security controls.

    Organisations and AI developers deploying these systems need to take responsibility to ensure that adequate safeguards are incorporated during design stage by following secure by design concepts and best practices. CERT-In has published guidelines for secure application design, development, implementation and operations.

    Each agent run should operate on task-specific, need-based privileges with separate, short-lived credentials. Network access must be restricted to required destinations at the network layer, not just through instructions to the model. Human confirmation should be mandatory for every consequential or irreversible action, and a tamper-resistant log of every tool call should be retained for a rolling period of at least 180 days, consistent with CERT-In directions of April 28, 2022, to enable identification and containment.

    MediaNama: Agents are often extended with skills, plug-ins and connectors from public marketplaces, some of which have been found to carry malware, and some agent installations have been found exposed on the Internet. Does CERT-In track these risks in India, and what has it found?

    Dr Sanjay Bahl: CERT-In recognises the risks associated with third-party skills, plug-ins and connectors used by AI agents, particularly those obtained from public repositories and marketplaces. Such components may introduce malicious functionality, vulnerable dependencies or unauthorised access capabilities, potentially leading to credential theft, data leakage or compromise of connected systems.

    CERT-In has been tracking emerging threats affecting AI-enabled systems through cyber threat intelligence, vulnerability analysis, incident investigations and proactive threat-hunting activities. For instance, CERT-In issued an advisory CIAD-2026-0053 in October 2026 concerning the compromise of LiteLLM PyPi package and docker images used in AI application infrastructure. Earlier, in April 2026, CERT-In had also highlighted multiple software supply-chain attacks involving open-source packages and developer tools, including components used in AI systems.

    Another concern is the exposure of AI agent infrastructure to the public Internet. Inadequately secured management interfaces, weak authentication and excessive access privileges can create opportunities for unauthorised access.

    CERT-In’s Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure, issued in May 2026 and its technical guidelines on Artificial Intelligence Bill of Materials (AIBOM) also address these concerns by recommending better visibility into deployed components, dependencies and exposed infrastructure.

    Organisations deploying AI agents should carefully assess third-party components before integrating them, maintain inventories of installed skills and connectors, review associated permissions and ensure that management interfaces are appropriately secured. Continuous monitoring and timely remediation of identified vulnerabilities are equally important.

    MediaNama: Many people now give an agent their passwords, card details or full inbox access because there is no narrower way to delegate. From a security standpoint, what should replace this, and who in India would need to build it?

    Dr Sanjay Bahl: Giving AI agents unrestricted access to passwords, financial credentials, email accounts or organisational resources introduces significant cybersecurity risks. Such access should be governed by established principles of least privilege, secure authentication, appropriate authorisation and accountability.

    CERT-In has already addressed these concerns in its advisory CIAD-2025-0013 best practices against vulnerabilities while using generative AI solutions, issued in March 2025. The advisory cautions users against sharing login credentials and sensitive information with AI applications and recommends carefully configuring and periodically reviewing permissions granted to AI tools connected with email, document repositories and other business applications.

    More recently, CERT-In advisory CIAD-2026-0049 AI agents as attack vectors: unauthorised access by agents under evaluation and misuse of open-source agentic AI tools, recommended assigning separate, short-lived identities to AI agents with least-privilege access.

    The preferred approach is to provide an agent with only the access required to carry out an authorised task, rather than unrestricted access to a user’s account. This can be achieved through appropriately scoped, time-bound and revocable permissions, along with independent approval for sensitive operations, particularly those involving financial transactions or modification of critical information.

    The responsibility for implementing these safeguards rests primarily with organisations developing, integrating and deploying AI agents, together with the service providers operating the underlying applications and platforms. Access controls should be enforced by these systems independently of the instructions received by an agent.

    CERT-In’s AI Security Blueprint and its technical guidelines on AIBOM provide further guidance on security governance, component transparency, dependency management and appropriate safeguards throughout the AI system lifecycle.

    As AI adoption increases, these established cybersecurity practices will remain central to protecting users and organisations.

    3. Reporting and investigation

    MediaNama: Under the April 2022 directions, incidents must be reported within six hours. If an agent is tricked into misusing its user’s credentials, or acts beyond what the user asked without any breach, is that a reportable incident? Who in the chain should report it: the agent’s developer, the organisation deploying it, or the platform on which it acted?

    Dr Sanjay Bahl: If an AI agent misuses credentials, gains unauthorised access to systems or information, or carries out unauthorised activities beyond its assigned scope, such activity constitutes a cybersecurity incident.

    The Information Technology (The Indian Computer Emergency Response Team and Manner of Performing Functions and Duties) Rules, 2013 cover real or suspected adverse events involving unauthorised access, unauthorised use of computer resources or unauthorised modification of information.

    Further, the CERT-In Directions dated 28 April 2022, issued under Section 70B(6) of the Information Technology Act, 2000, specifically include attacks or malicious/suspicious activities affecting Artificial Intelligence and Machine Learning systems under Category (xx) of Annexure I. Under these Directions, service providers, intermediaries, data centres, body corporates and Government organisations are required to report specified cybersecurity incidents to CERT-In within six hours of noticing the incident or being informed of it.

    Any entity which notices the incident shall report to CERT-In (all the entities – the agent’s developer, the organisation deploying it, the platform on which it acted can report to CERT-In). CERT-In advisory CIAD-2026-0049 AI agents as attack vectors: unauthorised access by agents under evaluation and misuse of open source agentic AI tools, also advises AI model developers to promptly notify affected organisations and CERT-In where their agents access live systems without authorisation. Individuals can also report cybersecurity incidents. The existing reporting framework is therefore applicable to AI agent-related cybersecurity incidents.

    Reporting incidents to CERT-In is cooperation for helping ensure that the overall ecosystem is safe and secure for all.

    MediaNama: If CERT-In were investigating an incident involving an agent, which records would it need, for instance the instructions the agent received, the tools it used and the actions it took? Are organisations keeping such records today?

    Dr Sanjay Bahl:

    For investigating incidents involving AI agents, one of the most important sources of evidence for CERT-In would be the complete AI agent activity transcript. This helps establish the instructions received by the agent, the tools it invoked, the commands it executed and the sequence of actions performed.

    Depending on the circumstances, CERT-In may also require information concerning the timeline of events, network communications, systems and resources accessed, files and credentials accessed or modified, cloud and API activities, configuration changes, relevant system and application logs, indicators of compromise (if known), and containment and corrective measures undertaken.

    An important aspect of such investigations is distinguishing between activities that an AI agent merely observed and those it actually initiated or performed.

    These records are part of the broader application, system and security logging relevant to cybersecurity investigations.

    The CERT-In Directions dated April 28, 2022 already require service providers, intermediaries, data centres, body corporates and Government organisations to enable logging of their ICT systems and securely retain logs for a rolling period of 180 days within the Indian jurisdiction. Such logs are required to be provided to CERT-In in connection with incident reporting or when directed.

    CERT-In advisory CIAD-2026-0049 AI agents as attack vectors: unauthorised access by agents under evaluation and misuse of open source agentic AI tools, also recommends maintaining tamper-resistant records of AI agent activities and monitoring model-initiated requests, including network destinations, protocols and the results of actions performed.

    As organisations adopt AI agents, their activity transcripts and associated technical records should form part of existing logging and incident investigation arrangements. Some organisations are capturing the conversation the agent had, but fewer organisations are at present capturing the complete, structured record of its tool calls and actions in a form that can be produced during an investigation. Capturing and maintaining these logs would help in detecting incidents, reconstructing events and determining their actual impact.

    MediaNama: CERT-In’s July 2025 technical guidelines include an AI bill of materials. An agent’s components change often: its model can be swapped, new skills added, and its memory grows. How should a bill of materials work for a system that changes in this way?

    Dr Sanjay Bahl: CERT-In’s Technical Guidelines on SBOM, QBOM & CBOM, AIBOM and HBOM, Version 2.0, issued in July 2025, already takes into account the evolving nature of AI systems.

    It recommends establishing workflows to update the AIBOM whenever new AI components or models are introduced or existing ones are modified. The guidelines also recommend automated AIBOM generation, maintaining model version histories and lineage, and integrating these inventories with vulnerability management processes.

    The same approach is to be applied to AI agents. An organisation should maintain an up-to-date inventory of the models, frameworks, third-party skills, plug-ins and software dependencies used by its agents. Changes such as replacing a model, adding a skill or modifying a dependency should be reflected automatically through appropriate updates, change control and version control. AIBOM for an agent must be a living, machine-readable inventory tied directly to the deployment pipeline.

    An agent’s memory and operational context require a slightly different approach. Relevant data sources, storage components and dependencies can be documented in the AIBOM, while changes to operational data and activities can be recorded through existing logging and audit mechanisms. This would avoid treating every change in an agent’s memory as a change in its software composition.

    The responsibility for maintaining an accurate AIBOM rests with the organisations developing, integrating and deploying AI systems.

    CERT-In’s guidelines provide the necessary framework for maintaining transparency, traceability and visibility into vulnerabilities throughout the lifecycle of AI systems, including those that change frequently.

    4. Looking ahead

    MediaNama: If more than half of the traffic on the Internet came from AI agents, how would that change the way CERT-In approaches attacks, monitoring and incident response? What would India need to have in place before that happens?

    Dr Sanjay Bahl: Even if autonomous AI agents were to account for a substantial proportion of Internet traffic, the fundamental principles of cybersecurity would remain unchanged. Secure system design, effective access controls, vulnerability management, continuous monitoring and timely incident response would continue to form the basis of cybersecurity.

    What would change is the speed, scale and level of automation at which cyber activities take place. Defensive capabilities would therefore need to evolve accordingly from human-speed monitoring and manual containment to continuous, automated machine-speed defence.

    CERT-In has been taking steps towards AI-enabled cyber defence. These include establishing an in-house Cyber Defence Centre that leverages AI models and open-source tools for proactive security assessments of critical government websites.

    CERT-In has put in place AI driven systems for situational awareness to detect malicious domains and phishing activities for necessary mitigation. CERT-In analysed over 9,800 billion DNS queries detecting 2.2 billion linked to malicious domains of which 128 million were phishing related. Over 3,000 phishing sites were mitigated affecting 695,000 users. This was also covered by the World Economic Forum in December 2025. CERT-In has also operationalised AI-enabled vulnerability assessments and an automated cyber threat intelligence exchange platform.

    In addition, CERT-In’s Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure, issued in May 2026, provides guidance on AI-aware security operations, continuous monitoring, automated detection and response, and strengthening organisational cybersecurity preparedness.

    Going forward, wider adoption of AIBOM, AI-assisted defensive technologies, effective implementation of established cybersecurity practices, capacity building and continued cooperation among stakeholders will be important for strengthening India’s resilience against emerging cyber threats.

    MediaNama: One proposal is that agents identify themselves in proportion to risk: declaring that they are agents when browsing, carrying a delegated token when logged in, and requiring fresh human authentication for payments or government applications. From an incident-response perspective, would this help, and what should such an identity contain?

    Dr Sanjay Bahl: Solutions aimed at improving the identification, authentication and authorisation of AI agents are welcome, particularly as these technologies become more widely deployed.

    From a cybersecurity incident response perspective, mechanisms that make agent activities traceable, establish the scope of delegated authority and support accountability could be useful. The proposed risk-based approach is worth examining. However, its effectiveness would depend on the technical architecture, the security of the underlying identity and authorisation mechanisms, and whether these mechanisms can provide reliable and verifiable evidence during an investigation.

    In general, an identity should carry an agent identifier, the person or organisation it acts for, the scope of what it may do, the task it is engaged in and an issuer’s signature so it cannot be forged. It should be designed with data minimisation, so it proves authorisation without leaking the user’s identity into every request.

    However, CERT-In would welcome further details of the proposed solution, including its technical specifications, security architecture, implementation approach and intended use cases. These could then be examined and appropriate comments provided from a cybersecurity and incident response perspective.

    MediaNama: What would be a useful first step from CERT-In on agents in the coming year, for instance guidance for organisations deploying them, or a channel to receive and share reports of agent incidents?

    Dr Sanjay Bahl: Both are two sides of the same coin.

    On one side, practical guidance for organisations deploying agents, the questions they may ask vendors, how to scope privileges, which actions should carry human confirmation, and what to log. On the other side is refining reporting and classification so that agent-involved incidents can be tracked and analysed as a category.

    In June 2026, CERT-In issued “Guidelines on AI-Accelerated Vulnerability Protection and Response Requirements for Original Equipment Manufacturers (OEMs) and Technology Providers“, covering secure development, vulnerability management, AI-assisted security testing and incident response. Organisation must leverage this guideline from CERT-In and ask questions to their OEMs and technology providers for satisfactory response.

    The immediate emphasis should therefore be on effective implementation of existing guidelines, continued monitoring of emerging threats and improving cybersecurity awareness and preparedness among stakeholders. In the unfortunate event of an incident, organisations must ensure they have maintained logs including the complete AI agent activity transcript. They should also maintain an up-to-date inventory of the models, frameworks, third-party skills, plug-ins and software dependencies used by agents. Organisations should report cybersecurity incidents to CERT-In within six hours of noticing the incident or being informed of it.

    CERT-In would continue to assess developments involving AI and agentic technologies and issue appropriate advisories and technical guidance as warranted by the evolving threat landscape.

    Also read:

    The post Interview: CERT-In chief on AI agent incidents, prompt injection and who must report them appeared first on MEDIANAMA.