RBI issues strict guidelines as AI agents breach bank systems quietly - Latest Key Updates

The Reserve Bank of India has issued a strict advisory for banks and payment companies. Following any unauthorized access, the entire tech system will be deemed compromised until forensic clearance is obtained.

In view of the looming cyber threat to the country's banking sector, the Reserve Bank of India (RBI) has adopted an extremely strict stance. The central bank has issued an essential advisory for all banks, payment system operators, and various other financial institutions under its regulatory purview. The directive clearly states that if credentials of any company are leaked or an unauthorized intrusion into the system is confirmed, the entire technology system must be considered compromised until a comprehensive forensic investigation is completed. The Reserve Bank took this decisive step on October 19.

Just prior to this move by the RBI, the Indian Computer Emergency Responding Team (CERT-In) had issued a grave warning regarding the increasing use of artificial intelligence (AI) agents in cyber attacks. Cybersecurity agency CERT-In made a frightening revelation in its warning issued on October 15. The agency stated that cyber criminals are now employing autonomous AI tools that independently discover system vulnerabilities without any human intervention, while these tools automatically execute commands and exploit security flaws to penetrate systems.

The report accompanying the RBI advisory revealed that in this financially motivated campaign against Indian companies, AI tools have drastically reduced attack execution times. Previously, hackers required several days to cause major damage after breaching a system, but now, with the assistance of AI agents, this task is completed within a few hours. Hackers deploy multiple AI agents simultaneously, which easily perform tasks ranging from covert surveillance to stealing sensitive data.

Companies Remained Unaware of Intrusion

The most shocking aspect of this entire incident was that many Indian companies remained completely unaware that AI agents had infiltrated their systems. This intrusion came to light only when the AI model developers themselves stepped forward to provide the information. They revealed that their AI systems had exceeded designated boundaries to access live business records, personal information of individuals, and confidential data belonging to companies.

In recent weeks, multiple cyber attacks have targeted Indian financial and technology companies. Early this month, reports emerged that approximately twenty financial institutions had been targeted. These attacks reportedly utilized stolen passwords of partner banks, and funds were allegedly extracted by exploiting vulnerabilities in payment and disbursement APIs.

Banks Must Take Immediate Strict Measures

The Reserve Bank has instructed financial institutions to strengthen cybersecurity arrangements not only for their own systems but also for their third-party service providers. To achieve this, the central bank has established clear and mandatory rules.

Removal of Admin Interfaces from Internet: Companies must immediately remove their management and administrative interfaces from public internet accessibility.

Strict Access Control: Implementing Multi-Factor Authentication (MFA) for administrative access will be mandatory. Access to cloud and backend systems will be restricted exclusively to personnel who strictly require it for their official duties.

Immediate Password Sanitization: Comprehensive audits of source code, repositories, configuration files, client applications, and cloud storage must be conducted to identify leaked passwords. Passwords identified as leaked must be changed immediately or permanently removed from the system.

Decommissioning Legacy APIs: All institutions must compile a complete inventory of their APIs. APIs or accounts that are no longer in use, have become obsolete, or were created solely for testing purposes must be shut down with immediate effect.

Real-Time Monitoring and Reporting Mandatory

The Reserve Bank has also instructed institutions to strengthen real-time monitoring of APIs. Banks must deploy systems capable of immediately detecting sudden spikes in automated requests, large-scale data extraction attempts, or suspicious account registrations. On top of that, in the event of any cyber incident, institutions are required to report the matter to the RBI Central Office and the relevant Regional Office within a stipulated timeframe. All companies have been directed to strictly comply with the advisories issued by CERT-In.