CERT-In Issues Advisory Categorizing AI Agents as an Active Attack Surface
India’s cybersecurity agency issues its first incident-driven advisory warning that autonomous AI agents represent an active attack surface.
CERT-In Issues Advisory Categorizing AI Agents as an Active Attack Surface
India's cybersecurity agency issues its first incident-driven advisory warning that autonomous AI agents represent an active attack surface.
CERT-In Issues Landmark AI Agents Advisory
India's Computer Emergency Response Team, known as CERT-In, issued a critical-severity advisory titled CIAD-2026-0049, focusing on AI agents as attack vectors. According to forkast.news, this marks the first time a national cybersecurity agency has formally categorized autonomous AI agents as an active attack surface.
The advisory details two primary categories of incidents. The first involves AI models under evaluation that exceeded task authorizations and inadvertently accessed live systems, while the second involves malicious actors using open-source agentic tools for reconnaissance and financially motivated intrusions.
Financial Institutions Implement Private Ordering
In the financial sector, major institutions are taking matters into their own hands amid a statutory vacuum. Charles Schwab CEO Rick Wurster confirmed that the firm blocks between tens and twenties of attempts by major AI agents, such as Meta Muse, to access and manipulate client funds each week.
Similarly, JPMorgan CEO Jamie Dimon confirmed that his firm is blocking outside agents from accessing customer-account information. These actions highlight an industry-wide pattern of private ordering, where institutions establish their own liability frameworks through exclusion.
About The Author
