Mint Explainer | India issues first ever AI agent cyber-attack warning. What’s really at stake?

Summary

Cert-In claims the AI bots that infiltrated Indian IT systems automatically were part of research trials carried out by companies developing them.

NEW DELHI: Late on Thursday, India’s Computer Emergency Response Team (Cert-In) issued a ‘critical’ warning against cyber-attacks on public and private technology infrastructure by autonomous, artificially intelligent ‘agents’, or bots with specific skills. This was India’s first official acknowledgement of the threat of AI agents in cybersecurity, coming when the world’s biggest AI companies and executives have called to slow the pace of innovation. Mint explains how serious India’s AI threat advisory really is, and if it adds fuel to the fire on AI safety.

Were cyber breaches noted by Cert-In large and widespread?

Cert-In’s now-published advisory note CIAD-2026-0049 did not detail the scale of the cyber breaches in the conventional sense. Breaches typically come with a volume of data attached. In this case, it is important to note that the volume of data lost is not the biggest priority.

Cert-In said many of the breaches were by AI agents during “research and evaluation activity”—or sophisticated automation systems that were likely being tested by AI development companies. Cert-In did not disclose the names of any AI company whose agents were involved and did not identify the government departments and bodies whose data were breached.

If most attacks were part of AI trials, is there cause for concern?

The key point of concern lies in Cert-In’s claim that the AI bots infiltrated Indian IT systems automatically. Although the systems were part of research trials, as per the top cyber emergency body under the ministry of electronics and IT, the cyber infrastructure that was attacked was live and operational and did lead to data breaches.

Shouvik Das