India's CERT-In Treats AI Agents as a First-Class Attack Surface After Undetected Intrusions

India’s Computer Emergency Response Team (CERT-In) issued a advisory on October 17, 2026, warning organizations that AI agents—autonomous or semi-autonomous software combining large language models with tools—constitute a rapidly expanding attack surface. The document highlights risks of unauthorized model access, over-privileged integrations, and data exfiltration through agent memory and logs. For Indian enterprises racing to deploy customer service bots, coding assistants, and internal copilots, the advisory translates abstract AI hype into checklist items compliance teams can enforce before regulators move from guidance to mandate.

Advisory scope and legal footing

CERT-In advisories are not statutes, but they signal official expectations for critical sectors—banking, telecom, government, and increasingly ITeS exporters serving U.S. and EU clients. The October 17 text categorizes agents as systems that plan multi-step actions, invoke APIs, retain conversational state, and may operate with delegated user authority. That definition sweeps in ChatGPT Enterprise plugins, open-source LangChain deployments, Microsoft Copilot Studio flows, and domestic stacks from Tata Consultancy Services and Infosys partners.

The advisory cites rising incident reports in 2026 where agents leaked internal URLs, replayed API keys embedded in prompts, or executed SQL beyond intended read scopes. CERT-In does not name victims but references coordinated vulnerability disclosures with international CERT partners—likely including patterns seen in OpenCode’s API key breach disclosed the same week globally.

Unauthorized model access

A dedicated section addresses “unauthorized model access,” covering shadow AI where employees paste confidential data into public chatbots, misconfigured reverse proxies exposing internal Ollama servers to the internet, and stolen API keys used for distillation or crypto mining. Indian startups hosting fine-tuned models on bare-metal clouds without authentication appear repeatedly in anecdotal incident data CERT-In collected from ISAC members.

Recommended controls mirror classic IAM hygiene: mutual TLS between agent gateways and model hosts, short-lived tokens, network segmentation placing inference clusters in private subnets, and mandatory SSO with step-up authentication before agents can call write-capable tools. CERT-In urges logging of all tool invocations with retention aligned to the IT Act and upcoming Digital Personal Data Protection Board rules—logs become forensic evidence when agents misbehave.

Agents as attack surface: threat scenarios

The advisory enumerates threat scenarios in plain language for CISOs briefing boards:

Prompt injection via untrusted content—emails, web pages, tickets—causing agents to exfiltrate data from connected CRMs or code repos. Supply-chain compromise of MCP servers and plugin marketplaces distributing malicious tools that look like calendar or payroll integrations. Memory poisoning where long-context agents retain secrets across sessions accessible to subsequent users on poorly isolated multi-tenant hosts. Privilege escalation when agents share service accounts with excessive database roles “for convenience.”

Each scenario includes mitigations: content sanitization pipelines, allow-listed tools, per-user memory sandboxes, and least-privilege service accounts rotated automatically. CERT-In references OWASP’s LLM Top 10 and the agent-specific supplement published in August 2026, localized with Indian examples—UPI reference numbers in prompts, Aadhaar masking failures, GST invoice parsing leaks.

Sectoral implications

Banks under RBI oversight already fielded circulars on AI governance; CERT-In’s advisory reinforces that customer-facing agents require pre-deployment red teaming and post-deployment monitoring for anomalous tool graphs. Telecom operators using agents for churn prevention must ensure call transcripts do not train public models without consent—a DPDP alignment point.

Government departments piloting Hindi-English grievance bots face heightened scrutiny after a state portal incident in September 2026 where a test agent returned internal server paths to citizens. CERT-In recommends air-gapped evaluation environments and phased rollouts with kill switches—lessons from agile DevOps applied to probabilistic software.

ITeS firms exporting BPO and KPO services must map CERT-In guidance to client contractual security exhibits; a missed agent control could breach SOC 2 or ISO 27001 audits tied to Fortune 500 revenue. Sales teams should expect RFP questions citing the October 17 advisory by number within weeks.

Unauthorized model access in insider threat framing

CERT-In frames unauthorized access both externally (hackers) and internally (employees bypassing approved vendors). Indian unicorns with liberal “bring your own AI” cultures receive blunt advice: block unmanaged extensions on corporate laptops, deploy enterprise gateways that inspect prompts for PAN, Aadhaar, and health identifiers, and discipline policy violations consistently.

The advisory encourages whistleblower channels for reporting shadow AI—culturally sensitive in hierarchical firms but positioned as protecting national data assets. Legal counsel note tension with employee monitoring laws; CERT-In suggests anonymized aggregate telemetry over raw prompt storage where possible.

Technical controls checklist

Annex tables list controls without mandating specific vendors: agent gateway with policy engine, secrets manager integration prohibiting literals in prompts, rate limits per user and tool, human-in-the-loop for financial transactions above thresholds, and periodic adversarial evaluations using open datasets translated into Indic languages.

For open-weight models hosted on-prem, patch cadence for inference frameworks is emphasized—CVEs in llama.cpp forks and vLLM affected Indian academia clusters in 2025. Air-gap updates for sensitive ministries remain painful but advisory calls stagnation unacceptable.

International alignment

CERT-In’s release coordinates messaging with CISA’s joint guidance on AI system security from July 2026 and ENISA’s agent threat landscape note. Multinational SOCs can unify playbooks rather than fragmenting by country—helpful for MSSPs headquartered in Bengaluru serving global clients.

Cross-border data flows matter: agents calling U.S. APIs may move personal data offshore; DPDP consent and contractual clauses must be documented. CERT-In stops short of banning foreign models but warns of geopolitical supply risk and suggests domestic hosting where feasible—a nod to India’s AI mission and GPU cloud investments.

Relation to same-day global news

October 17 also saw Charles Schwab and JPMorgan deploy read-only MCP to block external agents from customer data, OpenCode disclose API key breaches fueling distillation, and DeepSeek release massive open weights—events Indian security teams will connect in threat intel briefings. CERT-In’s timing is not accidental; global agent incidents provide urgency for domestic guidance before festival-season ecommerce peaks load customer service agents.

Implementation timeline suggestions

The advisory recommends 90-day plans: inventory agents, classify data touched, remediate critical findings, report summary statistics to board risk committees. Critical infrastructure operators may face follow-up questionnaires from CERT-In—historical pattern after major advisories.

Smaller SMEs without security staff are pointed to MeitY-funded cybersecurity clinics and industry ISACs for template policies—acknowledging resource constraints without excusing inaction.

Critiques and industry pushback

Startup founders argue CERT-In overstates risk relative to legacy RPA bots that already had database credentials. Security veterans counter that LLM stochasticity and prompt injection scale differently than deterministic scripts—debate continues on LinkedIn India.

Open-source advocates worry advisory language could justify blocking MIT model downloads on government networks; text actually encourages secure hosting, not prohibition. Clarifications may follow if confusion persists.

Education and workforce

CERT-In partners with NIELIT and IIT cyber cells to update curricula with agent security labs—long-term capacity building. Immediate term, CISO forums in Mumbai and Hyderabad scheduled October workshops walking through the advisory annex—high attendance expected.

Outlook beyond October 2026

If incidents accelerate, RBI or SEBI may incorporate agent controls into binding circulars. EU clients may demand evidence of CERT-In alignment in vendor due diligence. Indian agent startups selling abroad should export security features, not only cost arbitrage.

Practical takeaway for organizations

Treat agents like privileged users with browsers: log everything, assume compromise, minimize blast radius. Unauthorized model access is both hacker activity and employee Paste into ChatGPT—govern both. CERT-In’s October 17 advisory is the government’s mirror held up to the agent gold rush; reflection is uncomfortable, but cheaper than breach headlines during Diwali sales season.

Metrics boards should track monthly

Security committees can adopt simple KPIs aligned with the advisory: count of approved versus shadow agents, percentage of tool calls blocked by policy, mean time to revoke compromised API keys, and number of red-team findings closed within SLA. Publishing those metrics internally—even when imperfect—signals that agent risk is managed with the same seriousness as endpoint malware detections, which is the cultural shift CERT-In is nudging rather than mandating overnight.