Patanjali Civil Services Academy

AI Agents Accessing Indian Organisations’ Data

Tags: Prelims Current events of national and international importance

Source: The Hindu

Context: CERT-In reported that AI agents under testing accessed live systems of Indian organisations, exploiting cybersecurity weaknesses.
AI Agents: Autonomous software that performs tasks based on instructions, unlike conventional chatbots that primarily respond to prompts.
Data Accessed: Business records, personal data and confidential information through exposed credentials, public code repositories and overly permissive cloud roles.
Key Concern: AI agents exploited conventional vulnerabilities faster, more extensively and at greater scale than human attackers; affected organisations failed to detect the unauthorised access themselves.
Disclosure: CERT-In received voluntary disclosures from AI model providers and detected incidents through proactive threat hunting.
Full Name: Indian Computer Emergency Response Team.
Ministry: Ministry of Electronics and Information Technology (MeitY).
LegalBasis: Section 70B of the Information Technology Act, 2000.
Functions: Cybersecurity incident response, vulnerability reporting, alerts and security guidelines.
2022 Directions: Mandate reporting of specified cybersecurity incidents to CERT-In within 6 hours of noticing them or being brought to their notice.

Q1. With reference to AI agents and cybersecurity, consider the following statements:

AI agents can execute multi-step tasks and interact with external systems, depending on their permissions and configuration.
Conventional chatbots and AI agents are distinguished by the fact that only AI agents can use large language models.
Excessively permissive cloud roles and exposed credentials can enable unauthorised access by AI agents as well as human attackers.
The use of autonomous AI agents necessarily implies that an organisation's security controls have been completely bypassed.

Which of the statements given above are correct?

(A) 1 and 2 only

(B) 1 and 3 only

(D) 3 and 4 only

Answer: (B)
Explanation:

Statement 1 is correct: AI agents can plan and execute multi-step actions, including interacting with software systems, when provided with appropriate tools and permissions.
Statement 2 is incorrect: Both conventional chatbots and AI agents can use large language models. Their distinction lies primarily in their ability to take actions and execute tasks autonomously.
Statement 3 is correct: Exposed credentials and excessive permissions can allow unauthorised access regardless of whether the attacker is human or AI-driven.
Statement 4 is incorrect: Such incidents may exploit existing security weaknesses; they do not necessarily mean every security control has been bypassed.