MUMBAI: The Reserve Bank of India (RBI) has directed banks, payment system operators and other entities under its purview to treat their technology environments as compromised until forensically cleared following any exposure of credentials or confirmed unauthorised access.
The RBI issued the advisory on October 19, shortly after the Indian Computer Emergency Response Team (CERT-In) warned about the growing use of artificial intelligence agents to carry out cyberattacks.
The advisory, which ET has reviewed, said financial entities should strengthen cybersecurity controls across their own systems and those of third-party service providers.
Also Read: Extent of rate hike cycle to depend on growth-inflation outlook: RBI Governor
The RBI has also asked financial entities to remove management and administrative interfaces from public internet access, enforce multi-factor authentication for administrative access, and restrict access to cloud and backend systems on a least-privilege basis. The measures include auditing source code, repositories, configuration files, client applications and cloud storage for exposed credentials, and immediately rotating and purging compromised credentials.
Entities have also been directed to maintain an inventory of application programming interfaces (APIs) and shut down dormant, deprecated and test APIs and accounts. The RBI has also asked regulated entities to report such incidents to its central office and the relevant regional office within the stipulated timeline.
ET Bureau"Regulated entities are advised to leverage the information given in the CERT-in advisory and ensure implementation of appropriate measures by them and their third-party service providers," the advisory said.
The RBI has asked regulated entities to strengthen real-time monitoring of APIs, including systems capable of detecting sudden bursts of automated requests, bulk data extraction and suspicious account registrations.
Also Read: Inflation remains top of mind, MPC minutes show
On October 15, CERT-In warned that attackers were increasingly using autonomous AI tools to identify vulnerabilities, execute commands and exploit security weaknesses without continuous human intervention.
"In the financially motivated campaign against Indian entities, agentic tooling compressed the time between initial access and final impact from days to a few hours," CERT-In said in the advisory annexed to the RBI communication.
The cybersecurity agency found that attackers were using multiple AI agents simultaneously to conduct reconnaissance, exploit vulnerabilities and access sensitive information.
CERT-In said several Indian etities were unaware that their systems had been accessed by AI agents. The incidents came to light only after voluntary disclosures by AI model providers, whose systems had accessed live business records, personal information and confidential data beyond their assigned authorisation.
In recent weeks, a series of cybersecurity incidents has hit Indian financial and technology entities. Earlier this month, ET reported that around 20 financial institutions had been targeted in which stolen partner-bank credentials and vulnerabilities in payment and disbursement APIs were allegedly exploited to siphon off funds.