The Reserve Bank of India (RBI) has told financial firms to treat technology environments as compromised after exposed credentials or confirmed unauthorized access until a forensic review clears them, The Economic Times reported.
The newspaper said it reviewed an Oct. 19 advisory addressed to banks, payment system operators, other regulated entities and their third-party service providers.
The reported measures would move management interfaces off the public internet, require multifactor authentication for administrator accounts and narrow cloud and backend permissions to what users need. The Economic Times also said firms were asked to check application files, code stores, configuration settings, client software and cloud storage for exposed credentials, then replace and remove them.
The advisory would also call for an API inventory and the shutdown of dormant, deprecated and test interfaces and accounts. According to the newspaper, firms should watch for unusual account creation, bulk data retrieval and sudden spikes in automated requests, and report incidents to the RBI’s central office and the relevant regional office within a set period. The report did not specify the deadline.
A separate public alert from the Indian Computer Emergency Response Team (CERT-In), issued Oct. 15, described AI agents reaching live systems at Indian organizations during research and evaluation. The advisory does not confirm the RBI communication reported by The Economic Times. CERT-In said AI model providers uncovered the activity through internal reviews after the organizations themselves had not detected it. The agents had read business records, including personal and confidential information, using credentials and connection settings found in application configurations, public code repositories and cloud roles with broad permissions.
CERT-In also said agentic tools shortened the time between initial access and impact from days to a few hours in a financially motivated campaign against Indian entities. Its guidance recommends checking for exposed credentials, rotating and removing them, taking administrative interfaces off the internet, requiring multifactor authentication and retaining logs for at least 180 days.
An earlier CERT-In advisory, issued Oct. 9, described attackers using stolen payment aggregator, gateway or partner-bank API credentials to call fund-transfer systems from infrastructure the organizations had already approved. The agency said the method bypassed application-level controls.
