New Delhi: Cyber hygiene in India is “very weak” at a time when AI models carry “immense cyber capabilities”—this was the broad consensus among technology and telecom executives who spoke at a cyber hygiene workshop in New Delhi Monday. Their remarks came days after the Indian Computer Emergency Response Team (CERT-In) reported that AI agents had accessed the live systems of Indian organisations without authorisation.
The executives were speaking at a workshop on ‘Building a culture of cyber hygiene in the age of AI’, organised by industry coalition Safer Internet India (SII) and CERT-In—the national cyber security agency under the Ministry of Electronics and Information Technology (MeitY)—at the India International Centre.
CERT-In’s 15 October advisory, rated critical, said AI agents tested by model providers had read confidential business records maintained by Indian organisations, including personal data. It did not name the providers.
The workshop was held during National Cyber Security Awareness Month, which CERT-In observes in October.
OpenAI, Google to Airtel: Who said what
Responding to an audience question on AI models acting beyond their limits, Pragya Misra, head of Strategy and Global Affairs (India) at OpenAI, said the industry must use the window in which the technology remains within its developers’ control to secure systems, before those who plan to misuse it catch up.
Misra said that cases in which AI models exceeded authorised control were “very separate” from cases in which researchers sent models onto the open internet to find vulnerabilities. She said the company takes responsibility and has been transparent about them.
OpenAI has disclosed incidents in which its agents acted outside their bounds. In September, Australian Prime Minister Anthony Albanese said an OpenAI agent had accessed the country’s Medicare statistics portal in June.
Misra said OpenAI works with Indian government agencies and telecom operators, both of which run its models in the back end to detect patterns of cyber fraud before it is committed.
“Financial fraud is not India-specific, but it is India’s issue,” she said, adding that the company works directly with government agencies on it. OpenAI also shares information on coordinated misuse with social media platforms at the pattern level, without personal data, to track deepfakes as they move from private generation to public sharing.
Misra further said that OpenAI publishes what it learns and shares it with cybersecurity companies, adding that governments, the financial sector, the private sector and frontier AI labs must work together while this window lasts.
Aditi Chaturvedi, India Lead for Platforms & Devices, Government Affairs and Public Policy at Google India, said, “To ensure user safety, it is important to look at the cyber landscape differently for different generations.” She said government agencies share malicious APK files with Google on a regular basis, which it uses to update Play Protect, Android’s built-in app scanner. Since a pilot launched in 2024, Play Protect in India has blocked the installation of sideloaded apps that request permissions used to intercept OTPs.
Arun Gantayat, head of Pre-Sales at Kaspersky, said user awareness was the first line of defence. Panelists advised users to check lighting and shadows on video calls, call a person back before acting on an urgent request, and scan QR codes with caution.
At the second panel, on enterprise security, Rahul Vatts, Group Chief Regulatory Officer at Bharti Airtel, said, “Cyber hygiene is very weak in India.” He said enterprises treat AI as software, adding that employees upload company data to AI tools outside the organisation’s control, a practice known as shadow AI.
“AI cannot resolve all questions. Human input is crucial,” said S.S. Sarma, Scientist ‘G’ at CERT-In. “Cyber resilience is essential along with cyber security to ensure business continuity.”
Sarma said CERT-In guidelines are voluntary, while its directions are mandatory. Under 2022 directions, entities must report specified incidents to CERT-In within six hours. In July 2025, CERT-In added an ‘AI Bill of Materials’ to its technical guidelines, listing the components used to build, train and deploy AI models.
“AI has changed the speed and scale of threats,” said Vishal Gautam, vice-president and director, AI & Cyber Threat Research Centre (India), at Zscaler. He said small businesses should list the applications, devices and AI tools employees use, take off the internet any system that need not be exposed, and manage identity and access centrally.
“Priority is human-machine teaming. AI response should be taken forward by human response,” said Hiral Sharma, head of Architecture at Fortinet. Sharma said organisations run more than 20 security tools on average and should use existing tools in full before buying more.
Ayush Verma, India Lead at Resolver, said organisations deploying AI face three challenges: The first is knowing where a failure comes from. The second is testing once and not retesting after updates. The third is that safeguards tested in English may not work in the languages and mixed-language text Indian users write in. He called on companies to share AI misuse patterns through trusted channels.
SII is an industry coalition of digital service providers and telecom companies, launched in February 2025. It works against frauds and scams through information sharing, awareness campaigns and early warnings to government agencies. Members include Google and Meta, and Koan Advisory Group is its secretariat.
(Edited by Gitanjali Das)
Also Read: AI models could soon replicate themselves across smart TVs, fridges, Anthropic warns