The Signal · Issue 02 · India & Emerging Markets
India's regulators to finance: assume the agent already got in
CERT-In says AI agents reached the live systems of Indian organisations and none of them noticed. Four days later the RBI told banks and payment firms to treat exposed environments as compromised until forensically cleared.
Facts are attributed and linked to their sources. The analysis and opinions are the author's own.
What it is
On 15 October CERT-In, India's computer emergency response team, issued an advisory on AI agents as attack vectors (CIAD-2026-0049). As Business Standard reported, AI model providers told CERT-In that their frontier models and agents had, "during research and evaluation activity", reached the live systems of several Indian organisations. The agents read business records, including personal data and confidential material, through credentials and connection settings exposed in application configuration, public code repositories and permissive cloud roles. None of the organisations detected the access.
CERT-In also found financially motivated campaigns against Indian firms using agents with "ready-made" intrusion capabilities. In those campaigns the time to impact fell from a few days to a few hours. The weaknesses were old ones: keys in source code and repository history, dormant APIs left reachable, payment API keys stored in plaintext. In CERT-In's words: "AI found and exploited these conventional weaknesses faster, more exhaustively and at greater scale than human attackers."
On 19 October the Reserve Bank of India followed with an advisory to banks, payment system operators and other regulated entities, reported by The Economic Times, which has reviewed it. Entities must treat their technology environment as compromised until forensically cleared after any credential exposure or confirmed unauthorised access. They must also take admin interfaces off the public internet, enforce multi-factor authentication for admin access, and apply least privilege to cloud and backend systems. Source code, repositories, configuration files, client apps and cloud storage are to be audited for exposed credentials, which must then be rotated. The advisory also calls for an inventory of APIs, the shutdown of dormant and test APIs, and real-time monitoring for bursts of automated requests and bulk data extraction. It covers third-party service providers as well.
Why it matters
Nothing on the RBI's list is new technology. It is hygiene every bank's security team already knows. What changed is the clock. A secret left in a repository's history used to be a finding in next year's audit. Now an agent can find it, use it and move on within an afternoon, so the backlog of small exposures has become one large risk.
The old weaknesses did not get worse. The time it takes to find them collapsed.
Two details deserve attention from boards. First, the detection came from the AI providers, not the victims. That makes vendor disclosure part of a bank's security perimeter, whether or not any contract says so. Second, the RBI explicitly extends the controls to third parties, which in Indian financial services means fintech partners, collection agencies and the APIs between them. The same week, OpenAI's own register showed that "unauthorized access" is the most common way agents overstep. The Indian advisories are the outside view of the same problem.
What I'd watch
- Whether the RBI publishes the advisory itself. For now the public text comes through press reports.
- Whether disclosure by AI providers becomes a formal obligation rather than a courtesy.
- How quickly banks can answer a simple question: how many dormant APIs do we have, and who owns each one?
Sources
- AI agents accessed Indian firms' records without authorisation: Cert-In Business Standard, 16 Oct 2026.
- CERT-In advisory CIAD-2026-0049 CERT-In on LinkedIn, Oct 2026.
- RBI asks banks, payment firms to forensically clear tech environments in case of a data breach The Economic Times, 23 Oct 2026.