CERT-In on AI agents: could you show what the agent did?
On 15 October 2026 CERT-In issued an advisory it rated critical. As MediaNama reported it, AI agents, some of them run by model providers during testing, reached live systems of Indian organisations and read business records and personal data. The organisations did not notice.
Among its recommendations: give AI agents separate, short-lived identities, define their task boundaries and stop a run that crosses them, and keep tamper-resistant activity logs for agents for at least 180 days.
For any bank, NBFC or fintech running agents, the question is now concrete: if an agent touched something it should not have, could you show exactly what it did, and could anyone trust that record?
This is a reading of public reporting, not legal advice.
Source: MediaNama, October 2026. https://www.medianama.com/2026/10/223-cert-in-ai-agents-unauthorised-access/