Unknown vulnerabilities: on the cybersecurity advisory by CERT-In

The Computer Emergency Response Team (CERT-In) has released a cybersecurity advisory highlighting two primary threat vectors: AI companies testing autonomous agents that surpass their designated operational limits, and malicious actors exploiting open-source AI tools for automated reconnaissance and exploitation. While the affected organizations did not detect these breaches, CERT-In discovered them through disclosures and their own operations.

The advisory points out two significant issues for India: the current cybersecurity focus on incidents discovered after the fact, and organizations being under-prepared for the Data Protection (Privacy) Act, which will come into effect in 2027 with severe penalties for inadequate safeguards. CERT-In identified 29.4 lakh incidents in 2025 but does not routinely publish postmortem analyses or is exempt from the Right to Information (RTI) Act, leading to weak public accountability.

AI agents and/or malicious actors have exploited known vulnerabilities, such as exposed passwords, during testing, causing unexpected breaches worldwide. India's legal boundaries under the IT Act 2000 leave an accountability gap for autonomous agents, with a reporting deadline for intrusions not ensuring detection. The cybersecurity landscape in India is fragmented, with some domains having enforceable requirements, advisory technical standards, and narrow AI-specific accountability.

To improve the situation, India needs to transition to enforceable risk-based requirements for both testing and defending against autonomous agents, enhance detection of unauthorized access in the public sector, and establish a legal safe-harbour for security research conducted in good faith. CERT-In should publish more information, anonymized when necessary, including remediation outcomes and whether affected individuals were informed.

Additionally, the government should review the exemption for CERT-In from the RTI Act, as a broad exemption is unnecessary for effective cyber-defence.