CERT-in incident flags need for AI-enhanced security measures rather than

SENSEX 74,729.27

+ 413.66

NIFTY 23,146.15

+ 148.80

CRUDEOIL 9,570.00

+ 285.00

GOLD 147,903.00

+ 414.00

SILVER 211,286.00

+ 626.00

SENSEX 74,729.27

+ 413.66

NIFTY 23,146.15

+ 148.80

NIFTY 23,146.15

+ 148.80

CRUDEOIL 9,570.00

+ 285.00

CRUDEOIL 9,570.00

+ 285.00

GOLD 147,903.00

+ 414.00

'; } document.getElementById("lgdv").innerHTML = htmlElements; } function numberformat(i) { return Number(parseFloat(i).toFixed(2)).toLocaleString('en', { minimumFractionDigits: 2 }) } async function gatherResponse(response) { const { headers } = response; const contentType = headers.get('content-type') || ''; if (contentType.includes('application/json')) { return await response.json() } return response.text(); } function getWidth() { if (Math.max(document.body.scrollWidth,document.documentElement.scrollWidth,document.body.offsetWidth,document.documentElement.offsetWidth,document.documentElement.clientWidth) > 991) { document.getElementById("mob").style.display = "none"; document.getElementById("lgdv").style.display = "block"; } else { document.getElementById("mob").style.display = "block"; document.getElementById("lgdv").style.display = "none"; } } getWidth(); THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS.THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS.

At odds with this, Greyhound Research assessed the incidents as the failure of India’s defences against AI agents at detection

By Vallari SanzgiriS Ronendra Singh

Updated - October 18, 2026 at 12:39 AM. | Mumbai/ New Delhi

While the incident may recollect conversations around a slowdown on AI progress, experts agreed that the CERT-In incident calls for a more controlled development and testing, not a broad slowdown | Photo Credit: Alexander Sikov

India’s defence and enterprise sectors need to ramp up security measures and leverage AI to counter AI-enhanced cyber vulnerabilities proactively rather than reactively, experts said.

On Thursday, the Indian Computer Emergency Response Team (CERT-In) flagged certain “cyber incidents” involving Indian information and communication technology assets, where AI agents acted as the attackers. The recorded activity involved accessing business records, including personal data and confidential material, public code repositories, and permissive cloud-service roles through rogue AI agents.

While the incident may reignite conversations around slowing AI development, experts agreed that the CERT-In incident calls for more controlled development and testing, rather than a broad slowdown in AI progress.

“These incidents could largely have been prevented by isolating evaluation agents from live systems and closing basic security gaps. Slowing model research alone would not have protected organisations that left credentials, APIs and administrative systems exposed,” said Jaishiv Prakash, Director Analyst at Gartner, arguing that while India has strong cyber institutions, enterprise defences remain inconsistent.

Offering a contrasting view, Greyhound Research assessed the incidents as a failure of India’s defences to detect AI-agent-driven attacks.

“CERT-In records that in every case the AI model providers disclosed the incident, and that the affected organisations could not detect the unauthorised access on their own. Because CERT-In has not named those providers, nothing in the advisory ties the Indian cases to Anthropic. OpenAI, Anthropic and Google have each disclosed or confirmed incidents of this kind this year,” said Sanchit Vir Gogia, Chief Analyst and Founder of Greyhound Research. Gogia pointed out that, in the case of the Hugging Face incident, the open-source platform detected the intrusion using AI, and that the same approach should become standard practice for Indian defenders.

“Whatever speed with which you patch software, you cannot do it at the speed at which risks are identified. There are multiple layers of software, and patching everything is next to impossible. The only way to protect data is to secure it even after a breach. This is where privacy-enhancing technologies and cryptographic technologies become important. Protection has to be proactive,” said Abilash Soundararajan, Founder and CEO of PrivaSapien.

Meanwhile, attackers are already using AI to compress their timelines, said Ravindra Baviskar, Director of Sales Engineering (India and SAARC) at Sophos, a security software company. Citing its Active Adversary Report 2026, Sophos said attackers reach Active Directory about 3.4 hours after initial access, while 88 per cent of ransomware payloads are deployed outside business hours. A stolen credential can lead to domain control before most teams start their day.

“That calls for round-the-clock monitoring, identity threat detection with MFA across all access points, least-privilege access, timely patching, retained security logs, and incident-response plans tested for a 2 am scenario,” said Baviskar.

Similarly, the incident indicates a fundamental shift in enterprise security. Roshmik Saha, Chief Technology Officer at Skyflow, said: “The fact that organisations were unaware that agents had accessed their systems until they were informed by the model provider demonstrates that traditional security controls are not designed for systems that can independently navigate infrastructure, credentials, APIs and data.”

Anticipating more such attacks in the future, Vaibhav Koul, Managing Director, Protiviti Member Firm for India, said it is extremely important that organisations strengthen their cyber hygiene and leverage AI wherever possible to improve threat detection and response capabilities.

Published on October 16, 2026

THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS. THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS. THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS. THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS.Sign into Unlock benefits!

• Access 10 free stories per month
• Get notified by email for early preview to new features, discounts & offers