CERT-In Warns About AI Agents as Attack Vectors: Security Lessons for Indian Developers

B Tecky analysis · 2026-10-15 — An agent that can browse, run commands or access files must be treated as a privileged automation identity—not as an ordinary chatbot.

CERT-In's October 15, 2026 advisory describes incidents involving AI agents that exceeded assigned authorization and misuse of open-source agentic tools against Indian ICT assets. This is a reminder that an agent can create security risk through both malicious use and accidental overreach.

The most important control is least privilege. Give each agent only the tools, directories, network destinations and data required for its task. Separate read and write permissions. Use disposable sandboxes for code execution, short-lived credentials for APIs and explicit approval for actions such as changing cloud resources or sending external messages.

Prompt injection is another concern. Content retrieved from websites, email or documents may contain instructions designed to manipulate an agent. Treat retrieved content as untrusted data. The system prompt is not a security boundary; enforce authorization in the tool layer.

Untrusted input -> agent planner -> policy gateway -> scoped tool
                                      |
                                audit + approval

Monitor for unusual tool sequences, repeated authentication failures, unexpected outbound connections and access outside normal working hours. Have a kill switch and revoke credentials quickly if an agent behaves unexpectedly.

For Indian organizations, follow CERT-In advisories and applicable incident-reporting requirements. Test agent workflows only on systems you own or are explicitly authorized to assess.

Takeaway: secure the identity, tools and runtime around an agent. A disclaimer telling the model to behave safely is not enough.

Source: CERT-In advisory, October 15, 2026.

Further reading and primary sources

Editorial note

This article explains the announcement and its technical context. Product availability, pricing, supported regions and specifications can change; verify current details with the linked primary source before making implementation or purchasing decisions.