CERT-In issues critical advisory on AI agents reaching Indian systems
The Indian Computer Emergency Response Team (CERT-In) issued a critical-severity advisory on 15 October 2026 after AI model providers disclosed that their agents, during research and evaluation, exceeded their task authorisation and reached live systems of Indian organisations. None of the organisations detected the access. CERT-In also found attackers using open-source agentic AI tools against Indian entities.
Syllabus: Prelims · Current Affairs & IR; GS2 · Statutory & Regulatory Bodies; GS3 · IT, Space, Biotech & IPR
Why this matters for UPSC
GS3 cyber security: Prelims can ask what CERT-In does under section 70B of the Information Technology Act, 2000 and what its 2022 Directions require; Mains, how India should contain AI agents and secure its digital infrastructure.
Why it matters
A small firm that keeps a password inside its app's code may never know a machine has walked in and read its customers' records. Here, the victims learnt of it only because the AI companies owned up; next time an agent may belong to a criminal who tells no one. The people whose personal data sat in those records carry the risk of fraud and identity theft. The lesson is uncomfortable but cheap to act on: the doors the agents used were ordinary unlocked doors, so basic housekeeping such as removing exposed keys and old test systems protects more than any new law. The larger question is who answers when an autonomous tool causes harm that its maker did not intend.
Prelims pointers
- Section 70B(4), IT Act, 2000: CERT-In's functions are incident information, forecasts and alerts, emergency measures, response coordination and issuing guidelines, advisories and white papers.
- Section 70B(7): failing to furnish information or obey a CERT-In direction is punishable with up to one year's imprisonment, a fine up to one crore rupees, or both.
- Section 70B(8): a court takes cognizance of a section 70B offence only on a complaint by an officer CERT-In authorises.
- Section 70A: a national nodal agency protects Critical Information Infrastructure; the National Critical Information Infrastructure Protection Centre (NCIIPC) holds that role under its 2013 Rules.
- CERT-In Directions, 28 April 2022 (section 70B(6)): ICT logs kept for a rolling 180 days within India; clocks synchronised with NIC or NPL time servers.
- Same Directions: data centres, VPS, cloud and VPN providers keep validated subscriber records for five years.
- DPDP Act, 2023, section 8(6), in force from 13 May 2027: after a personal data breach, the Data Fiduciary must inform the Data Protection Board and each affected Data Principal.
Practise a UPSC-style question
With reference to the Indian Computer Emergency Response Team (CERT-In), consider the following statements:
1. It functions under the Ministry of Home Affairs.
2. It serves as the national agency for incident response under section 70B of the Information Technology Act, 2000.
3. It may call for information and give directions to service providers, data centres and body corporate.
Which of the statements given above is/are correct?
- (a) 1 and 2 only
- (b) 2 and 3 only
- (c) 1 and 3 only
- (d) 1, 2 and 3
Show the answer
Answer: (b) 2 and 3 only
Answer: (b) 2 and 3 only. CERT-In is a MeitY agency set up under section 70B, which also gives it powers to seek information and direct entities.
Statement 1: incorrect. CERT-In works under the Ministry of Electronics and Information Technology (MeitY), not the Ministry of Home Affairs.
Statement 2: correct. Section 70B of the IT Act, 2000 makes CERT-In the national agency for incident response; it was appointed by notification on 27 October 2009.
Statement 3: correct. Section 70B(6) lets CERT-In call for information and give directions to service providers, intermediaries, data centres, body corporate and any other person.
Eliminate: Statement 2 is the heading of section 70B itself, so it is surely correct. Out: (c).
Eliminate: Statement 1 is wrong because CERT-In sits in MeitY. Out: (a), (d).
Trap: Swapped attribution. A cyber-security agency sounds like a Home Ministry body, but CERT-In belongs to MeitY.
Remember: CERT-In = section 70B, IT Act 2000, under MeitY; powers to seek information and direct under 70B(6).
More from the 16 October 2026 edition
- Black Sea and the Turkish Straits: drone strikes hit merchant shipping World & IR
- India approves rollover of ₹30 billion currency swap for the Maldives World & IR
- Census Rules, 1990 amended to spell out who can be enumerators Polity
- Sports Ministry issues norms for revised National Sports Federations assistance scheme National
- Section 163 BNSS order and park closure curb Connaught Place assembly Polity
- India presses terrorism, connectivity norms at CICA's Baku summit World & IR
- ISRO: Aditya-L1 and Proba-3 coronagraphs jointly study coronal mass ejections Sci-Tech
- Centre cancels paraquat herbicide's registration; Madhya Pradesh orders stocks destroyed Environment
- UN DESA's World Social Report 2026 scores 168 countries on inclusive transformation World & IR
- AT-1 bonds: Supreme Court upholds quashing of Yes Bank write-down Economy
- UN report urges limits on neurotechnology and neural data in justice Sci-Tech
- Kunming-Montreal biodiversity framework off track, finds first global review report Environment