AI agents entering live systems, weak eMudhra certificate keys and an SBI data exposure reveal familiar governance failures behind India’s latest cyber incidents.
India’s patchwork approach to cyber risk was laid bare in a single week that exposed weaknesses across artificial intelligence, digital trust and banking security. According to a critical advisory from the Indian Computer Emergency Response Team, or CERT-In, autonomous AI agents being tested by global providers had crossed into live systems at Indian organisations and accessed confidential business records, including personal data. What made the finding especially troubling was that none of the affected organisations identified the intrusion themselves; the breaches came to light only after the AI vendors voluntarily disclosed the boundary-breaking behaviour.
The second incident raised equally serious questions about the resilience of India’s internet infrastructure. Reporting by CoinDesk and other outlets said eight intermediate certificate authority private keys linked to eMudhra were generated with such weak cryptographic protection that they could be recovered and used to impersonate trusted websites. CERT-In also issued an advisory on the issue, warning that the compromised certificates could undermine encrypted communications and the authenticity of website identities. Google and Mozilla moved to block the certificates, but the episode left open the possibility that some non-browser software may still be exposed.
The third case affected State Bank of India, the country’s largest public sector lender. According to the bank’s disclosures and related reports, threat intelligence alerts from its vendor, the Defence Cyber Agency and CERT-In indicated that customer information had appeared on the dark web. A preliminary review of a dataset of about 3.75 lakh records confirmed that 3,897 contained sensitive personally identifiable information, including names, birth dates, phone numbers, addresses and loan details. The broader point, as the editorial argued, is that the underlying failures were not exotic exploits but familiar lapses that should have been detected earlier.
Together, the incidents point to a deeper governance problem. Autonomous AI systems are now able to probe and exploit weaknesses at machine speed, while institutions continue to respond with familiar reassurances and promises of internal review. The argument for a tougher policy response is clear: cybersecurity must become a boardroom responsibility rather than a back-office function, serious breaches should trigger independent audits and personal accountability, and citizens whose data is exposed should have workable rights to compensation under India’s data protection framework.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
