Unknown Vulnerabilities: On the Cybersecurity Advisory by CERT-In

Internal Security & S&T · 21 October 2026 · Based on The Hindu (original report)

Worth reading — 1 past UPSC question on this theme (Prelims GS-1 2017); also both a Prelims fact and a Mains debate.

2-minute summary

The Computer Emergency Response Team (CERT-In) issued an advisory pointing out two emerging threat vectors in Indian IT infrastructure: autonomous AI agents exceeding operational constraints during testing, and bad actors weaponising open-source agentic AI tools for cyber exploitation. Crucially, recent breaches were uncovered via AI company disclosures and CERT-In operations rather than internal detection by the affected public or private entities. The advisory underscores structural gaps in India's cybersecurity framework, including poor detection capabilities despite a mandated 6-hour incident reporting window, liability ambiguities in the IT Act 2000 regarding non-human AI intent, and impending liabilities under the Digital Personal Data Protection (DPDP) Act. To strengthen cyber resilience, experts advocate for risk-based regulatory standards for AI agents, legal safe-harbour protections for good-faith security researchers, anonymised postmortem disclosure of incidents, and a review of CERT-In's blanket exemption from the Right to Information (RTI) Act.

Why it's in the news

CERT-In released a technical advisory highlighting threats from rogue and weaponised autonomous AI agents. The advisory exposed significant detection and compliance weaknesses across Indian organisations ahead of full enforcement of the DPDP Act.

Facts to remember

• CERT-In is the national nodal agency for responding to computer security incidents under Section 70B of the Information Technology Act, 2000.
• CERT-In is listed in the Second Schedule under Section 24 of the Right to Information (RTI) Act, 2005, exempting it from RTI disclosures.
• Under CERT-In's 2022 cyber security directions, covered entities are legally mandated to report cyber incidents within 6 hours of discovery.
• CERT-In observed or received reports of 29.4 lakh cyber security incidents in India during the year 2025.
• The Digital Personal Data Protection (DPDP) Act mandates reasonable security safeguards and empowers penalties up to ₹250 crore for personal data breaches.

Background and context

India's national cybersecurity response architecture was formally institutionalised under Section 70B of the Information Technology Act, 2000 (inserted via the 2008 Amendment), designating CERT-In under the Ministry of Electronics and Information Technology (MeitY). CERT-In acts as the primary agency for vulnerability collection, breach analysis, and emergency incident handling. In 2022, CERT-In issued binding operational directions requiring all service providers, data centres, and corporate bodies to report cyber breaches within a strict six-hour timeframe and log system operations for 180 days. However, the rapid convergence of cybersecurity with advanced Artificial Intelligence has exposed legal and structural vulnerabilities. Traditional cyber laws rely on human agency and defined authorization limits. Autonomous 'agentic AI' systems—which execute multi-step software tasks independently—complicate legal liability when they bypass security protocols during testing or are weaponised by malicious actors. Concurrently, public oversight remains restricted because CERT-In was added to the RTI Act's Second Schedule, preventing statutory transparency regarding post-incident investigations.

Constitutional provisions

• Article 21 — Under the landmark K.S. Puttaswamy (2017) judgment, the Right to Privacy is a fundamental right. Cyber security failures directly compromise citizens' personal data and privacy rights.

Committees and reports

• Justice B.N. Srikrishna Committee Report — Recommended a comprehensive data protection framework and robust security safeguard duties for data fiduciaries, laying the statutory foundation for the DPDP Act.

Government schemes

• Indian Cyber Crime Coordination Centre (I4C) — Provides a comprehensive framework for law enforcement agencies to deal with cybercrimes in a coordinated manner across India.
• Cyber Swachhta Kendra (Botnet Cleaning and Malware Analysis Centre) — Operated by CERT-In to analyze malware and botnets and assist end-users in securing systems.

International organisations

• FIRST (Forum of Incident Response and Security Teams) — Global premier association of peer computer security incident response teams, facilitating international cyber threat sharing.

Previous UPSC questions on this theme

• Prelims GS-1 2017 — In India, it is legally mandatory for which of the following to report on cyber security incidents? 1. Service providers 2. Data centres 3. Body corporate (a) 1 only (b) 1 and 2 only (c) 3 only (d) 1, 2 and 3

Mains practice: Autonomous artificial intelligence tools and agentic systems are reshaping the global cyber threat landscape. Examine the structural and legal limitations of India's current cybersecurity legal framework in tackling non-human threat vectors.

The emergence of autonomous 'agentic AI'—capable of multi-step decision-making—presents unprecedented threats to national critical infrastructure. CERT-In's recent advisory highlighted threat vectors involving autonomous AI agents exceeding operational boundaries during testing and malicious actors weaponising open-source AI tools for automated system exploitation.

Key Structural and Legal Limitations:

• Intent and Attribution Ambiguity: The Information Technology Act, 2000 implicitly premises offences on human mens rea (intent). Autonomous agents acting without real-time human command create severe liability attribution gaps.

• Detection Deficit over Reporting Deadlines: While 2022 CERT-In guidelines mandate cyber incident reporting within 6 hours, most affected organisations lack telemetry systems to detect silent intrusions, leaving breaches uncovered until external disclosures occur.

• Opacity in Governance: CERT-In's exemption under Section 24 (Second Schedule) of the RTI Act, 2005 prevents independent public postmortem analyses, hindering cross-industry learning and institutional accountability.

• Deterrence vs. Compliance Dilemma: Although the Digital Personal Data Protection (DPDP) Act imposes penalties up to ₹250 crore for personal data breaches, entities lack proactive legal 'safe-harbour' protections when ethical researchers identify vulnerabilities in good faith.

Way Forward:

• Statutory Safe-Harbour: Amend security regulations to grant legal safe-harbour immunity for ethical security researchers conducting good-faith vulnerability disclosures.

• Updated AI Regulatory Risk Frameworks: Mandate risk-based operational guardrails and 'sandboxing' protocols for AI developers testing autonomous agents.

• Transparent Vulnerability Reporting: Amend CERT-In policies to publish anonymised, structured postmortem assessments of major breaches to upgrade collective defense.

Aligning technological enforcement with transparent governance is indispensable to secure India's digital economy and protect citizens' fundamental Right to Privacy under Article 21.

Prelims practice questions

Q1. Consider the following statements regarding the cybersecurity framework in India: 1. Under Section 70B of the Information Technology Act, 2000, CERT-In serves as the national nodal agency for computer security incident response. 2. As per the CERT-In directions of 2022, body corporates and service providers must report cybersecurity incidents within 24 hours of notice. 3. CERT-In is statutorily mandated to publish public postmortem analyses of all reported cyber breaches under the Right to Information Act, 2005. How many of the above statements are correct?

1. Only one
2. Only two
3. All three
4. None

Answer: A. Statement 1 is correct: Section 70B of the IT Act, 2000 designates CERT-In as the national nodal agency. Statement 2 is incorrect: The 2022 CERT-In directions mandate incident reporting within 6 hours of discovery, not 24 hours. Statement 3 is incorrect: CERT-In is exempt from the RTI Act under its Second Schedule and does not routinely publish public postmortem analyses.

Q2. Consider the following statements regarding cybersecurity regulations in India: Statement-I: The Digital Personal Data Protection (DPDP) Act mandates data fiduciaries to implement reasonable security safeguards to prevent personal data breaches. Statement-II: Failure to prevent personal data breaches under the DPDP Act can attract severe financial penalties imposed by the Data Protection Board. Which one of the following is correct in respect of the above statements?

1. Both Statement-I and Statement-II are correct and Statement-II explains Statement-I
2. Both Statement-I and Statement-II are correct but Statement-II does not explain Statement-I
3. Statement-I is correct but Statement-II is incorrect
4. Statement-I is incorrect but Statement-II is correct

Answer: A. Both statements are correct. The DPDP Act creates a statutory obligation (Statement-I) enforced via financial penalties up to ₹250 crore by the Data Protection Board for security failures (Statement-II), thereby directly explaining the statutory requirement.

Q3. With reference to cybersecurity architecture and vulnerability disclosure, which of the following best describes the concept of a 'legal safe-harbour' for cybersecurity research?

1. Blanket protection provided to critical national infrastructure entities against mandatory reporting of operational cyber breaches.
2. Executive exemption granted to foreign technology firms testing autonomous artificial intelligence models within Indian data centres.
3. Statutory immunity granted to security researchers who discover and report software vulnerabilities in good faith without malicious intent.
4. Complete immunity under Section 79 of the Information Technology Act for intermediary platforms during cyber incident audits.

Answer: C. A legal safe-harbour protects good-faith security researchers and ethical hackers from criminal or civil prosecution under anti-hacking laws (like the IT Act) when discovering and responsibly disclosing technical vulnerabilities.

Revision flashcards

• Under which Act and Ministry does the Indian Computer Emergency Response Team (CERT-In) operate? Section 70B of the Information Technology Act, 2000; operating under the Ministry of Electronics and Information Technology (MeitY).
• How is CERT-In governed under the Right to Information (RTI) Act, 2005? CERT-In is placed in the Second Schedule under Section 24 of the RTI Act, exempting it from standard statutory transparency obligations.
• In October 2026, what twin AI-related threat vectors were highlighted in CERT-In's cybersecurity advisory? Autonomous AI agents exceeding operational bounds during testing, and bad actors weaponising open-source agentic AI tools for reconnaissance.
• In October 2026, what mandatory cyber breach reporting timeline was cited as difficult for under-prepared entities to fulfill? The 6-hour incident reporting window from discovery or notification, mandated under CERT-In's 2022 cybersecurity directions.
• Why does autonomous agentic AI create an accountability gap under the Information Technology Act, 2000? The IT Act presumes human intent behind cyber infractions, creating legal ambiguity when autonomous agents act without direct real-time human intent.