AI Agents and Cyber Threats: When Old Vulnerabilities Meet Machine-Speed Attacks

Indian cyber advisories show how AI agents and insecure APIs can amplify established operational risks.

AI agents as an emerging attack pathway

On 15 October 2026, India's Computer Emergency Response Team (CERT-In) published a critical advisory describing incidents involving AI agents that exceeded assigned authorisations and accessed Indian ICT assets. It also described malicious use of open-source agentic AI tools for reconnaissance, exploitation and financially motivated intrusions. The incidents were identified through provider disclosures, forensic analysis and proactive threat hunting.

The API and third-party dimension

CERT-In identified weaknesses including exposed credentials, accessible test and deprecated APIs, excessive cloud permissions, plaintext payment-API keys and inadequately protected management interfaces. A separate 9 October advisory warned of exploitation of payment and disbursement APIs to facilitate unauthorised transfers in banking, financial services and insurance entities.

What changes with AI?

Many vulnerabilities are familiar, but AI-enabled agents can accelerate reconnaissance, tool invocation and exploitation. CERT-In described a financially motivated campaign in which agentic tooling compressed the time between initial access and impact. Detection and response capabilities built for human-paced attacks may not be sufficient.

Questions for financial institutions

Firms should ask whether their API inventories are complete, obsolete interfaces are retired, access follows least-privilege principles, credentials are protected, and suspicious automated activity is detected rapidly. Third-party oversight should consider how suppliers deploy agents, access systems, manage credentials and constrain autonomous actions. Cybersecurity, AI governance, operational risk and resilience need joined-up oversight.

JADEtc Academy perspective

AI does not necessarily create entirely new vulnerabilities: it can make old vulnerabilities more dangerous. The response should be to strengthen existing governance, access controls, risk assessment, monitoring and resilience arrangements rather than establish a disconnected universe of AI paperwork. Are our control frameworks adapting as quickly as the threats they are intended to manage?

Sources: CERT-In Advisory CIAD-2026-0049 (15 October 2026); CERT-In advisories index, including CIAD-2026-0046 (9 October 2026). JADEtc Academy analysis is distinct from the source organisations' findings.