RBI tells banks to presume compromise after credential exposure

The Reserve Bank of India has directed banks, payment system operators and other regulated entities to treat their technology environments as compromised following any exposure of credentials or confirmed unauthorised access, until those environments receive forensic clearance.

The October 19 advisory also calls for stronger cybersecurity controls at financial entities and their third-party service providers, according to The Economic Times, which reported reviewing the communication. It follows an October 15 warning from the Indian Computer Emergency Response Team (CERT-In) about the increasing use of autonomous artificial intelligence tools in cyberattacks.

Tighter controls on credentials and administrative access

The RBI has asked financial entities to take management and administrative interfaces off the public internet and require multi-factor authentication for administrative access. Access to cloud and backend systems should follow the least-privilege principle, limiting permissions to those needed for a particular task.

The measures include checking source code, repositories, configuration files, client applications and cloud storage for exposed credentials. Compromised credentials must be rotated and purged immediately.

Regulated entities have also been directed to maintain an inventory of application programming interfaces, or APIs, and shut down dormant, deprecated and test APIs and accounts. They must report incidents to the RBI’s central office and the relevant regional office within the stipulated timeline; the report does not specify that deadline.

Monitoring for automated attacks

The advisory asks entities to strengthen real-time API monitoring, including the ability to detect sudden surges in automated requests, large-scale data extraction and suspicious account registrations. It also asks them to use the information in CERT-In’s warning to implement appropriate safeguards across their own operations and those of service providers.

In its October 15 advisory, annexed to the RBI communication, CERT-In warned that attackers were increasingly deploying autonomous AI tools to find vulnerabilities, execute commands and exploit weaknesses without continuous human intervention.

The agency said agentic tools used in a financially motivated campaign against Indian entities had reduced the interval between initial access and final impact from days to a few hours. Attackers were using multiple AI agents simultaneously for reconnaissance, exploitation and access to sensitive information.

Some intrusions went unnoticed

CERT-In said several Indian entities did not know AI agents had accessed their systems. The incidents emerged only after voluntary disclosures by AI model providers, whose systems had accessed live business records, personal information and confidential data beyond their assigned authorisation.

The report also referred to earlier reporting this month that around 20 financial institutions had been targeted in incidents allegedly involving stolen partner-bank credentials and weaknesses in payment and disbursement APIs to siphon off funds. That account describes alleged methods of attack, not independently established findings.