CERT-In alert raises focus on agentic AI guardrails
Cybersecurity experts advocate for technical access controls and human oversight after CERT-In issued a critical advisory on autonomous AI agents accessing Indian systems without authorization.
Cybersecurity experts have called for tighter technical controls, real-time monitoring and human oversight in agentic artificial intelligence (AI) deployments, warning that autonomous systems can exceed their authorised scope and exploit vulnerabilities faster than human attackers. The concerns follow a critical-severity advisory issued by the Indian Computer Emergency Response Team (CERT-In) on October 15, which flagged incidents involving AI agents accessing Indian information and communication technology assets beyond their assigned authorisation.
“An instruction to the model is not a control,” Atul Arya, founder and CEO of Blackstraw, said, stressing that every agent must have a defined role and be technically prevented from accessing systems beyond its remit. Blackstraw aids enterprises in AI implementation using a platform approach. The CERT-In advisory said AI models conducting research and evaluation had accessed live systems and read business records, including personal data and confidential material, through exposed credentials and permissive cloud roles.
In separate incidents, attackers used open-source agentic AI tools for reconnaissance, exploitation and financially motivated intrusions. Jaydeep Singh, general manager – India at Kaspersky, said clear boundaries were a starting point. “Every AI agent should have its own identity and access to only what it needs,” he said, adding that research and testing should be kept separate from production. High-impact or irreversible actions should require human approval, while strong authentication, network segmentation and centralised logging can help detect misuse.
Affected organisations failed to detect the unauthorised access themselves, CERT-In said. In attacks against Indian entities, agentic tools compressed the time between initial access and final impact from days to hours. Conventional weaknesses, including exposed keys, obsolete APIs, excessive cloud permissions and unpatched systems, were exploited at greater speed and scale. Ravindra Baviskar, director, sales engineering (India and SAARC) at Sophos, said the priority should be technical restrictions rather than relying on an agent to follow instructions.
“The priority guardrails are the ones that technically limit what an agent can reach, rather than ones that rely on the model following instructions,” he said. Organisations should also maintain tamper-resistant logs and ensure a designated person can terminate an agent mid-task. Basic safeguards include rotating exposed credentials, disabling dormant application programming interfaces (APIs) and removing administrative interfaces from public networks.
The advisory also highlighted conventional security weaknesses, including exposed credentials and keys, dormant or deprecated APIs, payment API keys stored in plaintext, over-permissive cloud roles and internet-exposed management interfaces. CERT-In recommended auditing and rotating exposed credentials, decommissioning unused APIs, enforcing multi-factor authentication and retaining logs for at least 180 days.
Financial services, fintech, healthcare, IT services, telecom and government are among the sectors requiring particular attention, experts said, given their access to sensitive data and interconnected systems. On regulation, Arya said India’s approach of relying on existing laws and sectoral regulators was sensible, but accountability remained unclear when an AI agent operating for one organisation accessed another’s systems. He called for industry participation in shaping safeguards as agentic AI adoption expands.
