Unknown gaps

Why in the News

India’s cyber rules require organisations to report a breach within six hours, yet the organisations hit by recent artificial intelligence (AI) agent intrusions never detected them. An advisory by the Indian Computer Emergency Response Team (CERT-In) shows the breaches surfaced only through AI companies’ disclosures and CERT-In’s own operations, exposing a system that responds after incidents are revealed instead of finding them.

What did CERT-In’s advisory flag?

1. What it is: CERT-In is India’s national agency for cyber incident response under Section 70B of the Information Technology (IT) Act, 2000. Its advisories warn of threats, like fire safety notices.
2. Rogue test agents: AI companies testing autonomous agents, software that plans and acts on its own, let them go beyond the limits set for them, their designated operational constraints, and reach Indian systems.
3. Weaponised open-source tools: Bad actors are using freely available open-source agentic AI tools for automated reconnaissance and exploitation, meaning machines find weak points and break in unaided.
4. Old weaknesses exploited: The agents and attackers used known flaws such as exposed passwords. These are ordinary security lapses that exist independently of AI agents.
5. The takeaway: Autonomous agents turn ordinary security lapses into breaches faster than organisations can notice them.

Why did the breaches go unnoticed?

1. Global pattern: AI companies and labs have disclosed several cases this year of agents unexpectedly breaching real-world infrastructure during testing worldwide.
2. After-the-fact system: Existing arrangements deal with cybersecurity incidents after they are revealed, so they depend on someone else noticing first.
3. Deadline without detection: Many organisations cannot or will not discover an intrusion. A six-hour reporting deadline therefore cannot make them find breaches.

Why is accountability for breaches weak?

1. Scale without disclosure: CERT-In observed or received reports of 29.4 lakh incidents in 2025. It does not routinely publish postmortem analyses of what went wrong.
2. RTI exemption: CERT-In is exempt from the Right to Information (RTI) Act, 2005, so citizens cannot seek its records on breaches and responses.
3. Exemption not needed: Security bodies are exempted so disclosures do not help attackers. Anonymised reports would not expose operations, so a sweeping exemption for CERT-In is unnecessary for effective cyber-defence.
4. Gap in the IT Act: The legal boundaries the IT Act sets assume a human intention behind an intrusion. An autonomous agent acting without one leaves an accountability gap.
5. DPDP readiness: The breached organisations were under-prepared for the Digital Personal Data Protection (DPDP) Act, 2023. From 2027 it imposes steep penalties on entities lacking reasonable safeguards against breaches.

Is India’s cyber framework ready for autonomous threats?

1. Fragmented landscape: National cybersecurity rules are a patchwork of three kinds:
   • enforceable requirements in some domains;
   • advisory technical standards in others;
   • narrow AI-specific accountability in yet others.
2. Rising sophistication: Human and autonomous threat actors, the people and programs that launch attacks, are growing more capable and exploit the gaps a patchwork leaves.

Challenges

1. Weak detection capacity: Many organisations, especially in the public sector, lack monitoring that can catch machine-speed intrusions. Eg. The 2022 ransomware attack on AIIMS Delhi’s servers.
2. Compressed response time: Agentic tools shorten an attack from days to hours, leaving defenders little time to contain it.
3. No shield for researchers: Unauthorised access is an offence under the IT Act, so good-faith security researchers who probe for flaws risk prosecution.

Way Forward

1. Risk-based rules for agents: Replace the patchwork with enforceable risk-based requirements for both testing and defending against autonomous agents.
2. Public sector detection: Build the capacity to spot unauthorised access, in government systems first.
3. Safe harbour: Give a legal safe harbour, protection from prosecution, to security research done in good faith, in line with CERT-In policy.
4. Anonymised disclosures: CERT-In should publish more information, anonymised where necessary, including remediation outcomes and whether affected individuals were told.
5. RTI review: The government should review CERT-In’s exemption from the RTI Act.

Conclusion

India’s cyber regime waits for breaches to be reported, but autonomous agents are breaching systems whose owners cannot see them. Whether CERT-In starts publishing what it learns, and whether the law assigns liability for agents acting alone, will decide how prepared India is.

Back2Basics: Digital Personal Data Protection Act, 2023

1. Scope: India’s first standalone law on processing personal data, built around the consent of the person whose data it is.
2. Data Protection Board of India: The Act creates this body to adjudicate complaints and breaches and impose penalties.

Matching Previous Year Question

“[2022, GS3, 10 marks] What are the different elements of cyber security? Keeping in view the challenges in cyber security, examine the extent to which India has successfully developed a comprehensive National Cyber Security Strategy.”