CERT-In Flags AI Agent Cyber Risks; India Urges Companies to Tighten Security, Weighs Regulation

India's national computer emergency response team, CERT-In, has flagged cybersecurity risks arising from AI agents, according to a report from Moneycontrol. The move prompted the government to urge companies to tighten their security, while authorities are also weighing regulation for the technology.

The report points to two signals at once: an immediate request for companies to harden their defenses, and a policy-level intent to leave room for oversight of AI agents. The public information so far is directional rather than detailed.

AI agents differ from chat-style AI in that their risk surface is action. They do not merely generate text; they call tools, move data and execute multi-step operations across connected systems — so when they are misused or derailed, the consequences land on real business processes and data.

That is why regulators are paying attention to agents specifically. As enterprises deploy them in customer service, operations and engineering workflows, agents effectively inherit a slice of access to internal systems, which makes permission design the core of any security plan.

For companies operating in India, an advisory of this kind usually means revisiting permission boundaries, logging and audit trails, and human fallback mechanisms — especially in scenarios where an agent is allowed to make external requests on its own.

The next things to watch are whether CERT-In publishes more specific guidance, and what shape regulation takes — a dedicated set of rules for agents, or an extension of existing cybersecurity and data governance frameworks. Both remain early-stage.