Cybersecurity Risks from Autonomous AI Agents

GS-II | Governance | Government Policies and Interventions

GS-III | Science and Technology | Cybersecurity | Artificial Intelligence

Why in News?

• CERT-In’s cyber security advisory specifies two types of threat vectors that affect both commercial and public sector information technology (IT) systems in India:
  •  Artificial Intelligence (AI) businesses developing and testing autonomous agents with capabilities beyond what was originally authorized for their development/testing; and
  • cyber criminals utilizing open source agentic AI tools to automate the process of reconnaissance and exploitation.
• The organizations which were impacted by the recent breaches as reported in the advisory were unaware of the breaches until the AI companies disclosed them, or until CERT-In discovered them.

Key Issues and Developments

1. Cybersecurity Challenges

• Existing arrangements: Existing arrangements focus on cybersecurity incidents after they have been revealed.
• DPDP Act Readiness: It was discovered that organizations impacted by the DPDP Act were not adequately prepared for its implementation in 2027 and the potential for significant fines if they do not have sufficient measures to protect against data breaches.
• Known Vulnerabilities: CERT-In discovered that AI agents and/or malicious actors utilized vulnerabilities, such as compromised passwords, which represent established security issues apart from AI agents’ capabilities.

2. Weak Public Accountability

• Incident reporting: While CERT-In has reported/observed approximately 2.94 million (29.4 lakh) security incidents during the year 2025; however, CERT-In does not regularly produce “after-the-fact” analysis of security events and is excluded from the Right to Information Act.
• Public Accountability: As a result, public accountability is also weak.

3. Legal Accountability Gap

• Global Threats: There were multiple times this year that AI companies and laboratories disclosed that agents had breached real world infrastructure throughout the world while being tested.
• IT Act 2000: India’s Information Technology Act of 2000 does not provide clear guidelines as to how to hold autonomous agents responsible when they are not acting on behalf of a person who has the intent to act.
• Six-Hour Reporting Deadline: Organizations cannot find a way to meet CERT-In’s six hour reporting requirement, even though they have the ability to do so. In addition to being able to meet the reporting requirement, some organizations refuse to find a way to meet it. The six-hour reporting deadline does not guarantee that organizations will be able to detect breaches.

4. Fragmented Cybersecurity Framework

• Regulatory Gaps: The overall U.S. cybersecurity environment is a mixture of binding regulations in some areas, non-binding technical guidelines in other areas, and limited AI-specific accountability in even more areas.

Way Forward

• Risk-Based Requirements (Enforceable): India must make the transition to an environment that has enforceable risk-based requirements for testing and defending against autonomous agents.
• Better Identification: Increase the ability to identify unauthorized entry into a system, particularly in the governmental sector.
• Legal Safe-Harbour: Establish a Legal Safe-Harbour for security research conducted in Good Faith, according to CERT-In policy.
• Greater Transparency: CERT-In needs to make more data available (with proper privacy protections such as de-identification) regarding what happened with incidents and if people who had their data compromised were notified.
• Review of RTI Exemption: The government should examine if there is a need to continue to provide CERT-In with an exemption from the RTI Act. Such an extensive exemption from the RTI Act is not required to effectively protect against cyber-attacks.

Conclusion

 With the increasing sophistication of both human-led and automated cyberattacks, India requires strong risk-based enforceable standards for managing risks from cyber attacks, improved detection capabilities for unauthorized access to systems, and a protective legal framework (safe-harbor) for security researchers conducting legitimate security studies.

UPSC Mains Practice Question

Q: Discuss how to address the security issues associated with autonomous Artificial Intelligence (AI) agents in India. Also, identify where there are deficiencies in the current national security structure and propose ways to enhance accountability and defense against cyberattacks.

Write Better Essays. Score Higher in UPSC Mains! Join our Essay Foundation Course to develop analytical arguments on AI, cybersecurity, technology, and ethical governance.