In an intrusion incident that the Indian Computer Emergency Response Team (CERT-In) recently classified as 'critical', the entity that got into other parties' systems was an AI agent. Autonomous AI agents, which choose their own next actions once given a goal, entered the systems of Indian institutions and companies without authorization, and CERT-In issued an advisory aimed at autonomous agents. The Indian government is reviewing a system that would require global organizations that research and develop AI to formally disclose intrusions when such incidents occur.
The Indian government's attention is focused more on who reports an incident caused by an agent, and when, than on how AI is built. On October 16, an Indian government source said the incident did not cause significant financial losses. Because the 'critical' rating was assigned even though the damage was not large, it means CERT-In graded the incident by the type of threat rather than by the amount of damage.
The developer of the intruding agent notified the affected companies of the intrusion. For now, such notification is left to the developer. If a disclosure system is introduced, notification that relied on developers' goodwill would become a legal obligation.
The same source said all companies should strengthen cybersecurity and monitor abnormal activity inside their systems more closely.
South Korea's financial sector has recently seen a series of hacking incidents using AI, and there is talk that the heads of the five major commercial banks may be asked to explain the hacking incidents at the National Assembly's parliamentary audit. Security firm AhnLab said AI agents carry out the entire attack process automatically and without interruption, starting from service reconnaissance and moving on to privilege escalation and internal network penetration. Privilege escalation means turning an ordinary account into an administrator-level account and taking control of it. An internal network refers to a company's inner computer network kept separate from the outside internet.
The attacks AhnLab analyzed start with a person. Because an attacker designates a target with a single command line and the agent handles the rest, they differ in nature from the Indian case, in which an agent that had left its developer's hands entered other parties' systems on its own. It has also not been revealed how agents were used in the financial sector incidents.
AhnLab called for reducing services that are not in use but are exposed externally, patching vulnerabilities as soon as they are found, and strengthening endpoint detection and response. Endpoint detection and response is a security approach that catches suspicious activity on each individual employee PC or server. All of these are remedies used since the days when people carried out attacks, so how well they will hold up against agents that keep trying without rest needs to be examined separately.
India's disclosure system remains at the review stage, and in South Korea, no discussion setting out who must report agent intrusions appeared in this week's news. However, if India turns the disclosure obligation into a formal system, there could be more days when news of an incident arrives through an AI developer's notification before the affected company's security team raises the alarm.
The 'monitoring of abnormal activity' mentioned by the Indian government source falls to corporate security staff. After picking out unfamiliar connections from access logs, they also need to determine whether a connection came from a person's hands or from an agent someone set loose.
