Mint Explainer | India issues first ever AI agent cyber-attack warning. What's really at stake?

Summary

Cert-In claims the AI bots that infiltrated Indian IT systems automatically were part of research trials carried out by companies developing them.

NEW DELHI: Late on Thursday, India's Computer Emergency Response Team (Cert-In) issued a 'critical' warning against cyber-attacks on public and private technology infrastructure by autonomous, artificially intelligent 'agents', or bots with specific skills. This was India's first official acknowledgement of the threat of AI agents in cybersecurity, coming when the world's biggest AI companies and executives have called to slow the pace of innovation. Mint explains how serious India's AI threat advisory really is, and if it adds fuel to the fire on AI safety.

Were cyber breaches noted by Cert-In large and widespread?

Cert-In's now-published advisory note CIAD-2026-0049 did not detail the scale of the cyber breaches in the conventional sense. Breaches typically come with a volume of data attached. In this case, it is important to note that the volume of data lost is not the biggest priority.

Cert-In said many of the breaches were by AI agents during "research and evaluation activity" -- or sophisticated automation systems that were likely being tested by AI development companies. Cert-In did not disclose the names of any AI company whose agents were involved and did not identify the government departments and bodies whose data were breached.

If most attacks were part of AI trials, is there cause for concern?

The key point of concern lies in Cert-In's claim that the AI bots infiltrated Indian IT systems automatically. Although the systems were part of research trials, as per the top cyber emergency body under the ministry of electronics and IT, the cyber infrastructure that was attacked was live and operational and did lead to data breaches.

Cert-In did not divulge details of the extent of the data breaches, which it claimed were discovered through responsible disclosures made by the AI companies as well as Cert-In's "own proactive threat hunting."

The other cause for concern is that the AI breaches could do in hours what previous cyber attackers needed days to execute. This drastically reduces the time that a company has to detect, prevent and respond to a cyber-attack. On 21 January, Mint reported that India had a large cybersecurity engineering talent gap, which could exacerbate these concerns.

Which companies were involved in this incident?

Cert-In has mentioned only that a select few government bodies as well as Indian "entities" were affected. It also said that while many of the breaches were a part of trials by AI companies, some were carried out by cyber criminals with the intent of damaging systems and stealing data. However, no AI companies or cyber-criminal groups were identified.

Mint's emails to Anthropic, Google, Microsoft and OpenAI, among the world's top AI model developers today, did not immediately receive responses.

What does India really lack in the face of AI adversaries today?

Cert-In pointed to a 38-page user-readiness handbook it published on 25 May for best practices to take preventative measures against AI threats. The handbook offers enterprises and government bodies a blueprint to establish operational readiness, set up air-gapped defensive controls and have a strong incident response team as key parts of handling threats.

India, however, has historically been a laggard in cybersecurity spending. Consultancy firms Bain & Co and Gartner said in reports they published in March that 20% of India's annual IT spending of $3.4 billion went into cybersecurity. However, India ranks considerably behind mature western nations in cybersecurity, underlining the need for greater investment in cybersecurity for the AI era.

Mint's report on the shortage of cybersecurity talent is another point to keep in mind for skilling initiatives. Finally, Cert-In has urged companies to "detect attacks at machine speed" -- a feat that may require access to significantly more powerful IT hardware than what most systems do.

Amid acknowledging its first AI threat, are India's cyber policies ready?

So far, India's cyber regulations remain fragmented. India's Cert-In Rules, 2022, gives the body powers to enforce financial penalties on non-compliant companies. However, there is no dedicated, singular 'cyber law' and AI regulations remain sector-specific and more recommendatory in nature.

In case of AI breaches, policy experts said it may be unclear which party should be penalized -- the company that made the agent, the team that operated it, or both. AI companies claim they are intermediaries and are thus eligible for safe harbour protection.

However, it remains unclear what regulations would define a company when its research division becomes part of a cyber-attack team.