Tag: Cybersecurity

How Three Indian-Origin Hackers Used Anthropic’s Claude to Uncover OpenAI Security Flaws

Three Indian-origin cybersecurity researchers—Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini—demonstrated how Anthropic’s Claude AI could be used to exploit vulnerabilities in OpenAI’s systems. The researchers, working at cybersecurity startup Hacktron AI, gained access to OpenAI employee ChatGPT accounts and an internal code repository before responsibly disclosing the vulnerabilities. OpenAI later awarded the team a $6,500 bug bounty.

Who Are the Researchers?

The research team was led by Harsh Jaiswal, alongside Mohan Pedhapati and Rahul Maini. The trio began investigating security weaknesses at frontier AI companies as part of their work at Hacktron AI. Their research focused on vulnerabilities that could connect OpenAI’s community forum with employee accounts and internal services. The entire process, from initial discovery to demonstrating access to an internal repository, took less than 72 hours. The researchers also spent under $3,000 on AI tokens during the broader investigation.

How Did Claude Help the Researchers?

The researchers identified a remote-code-execution vulnerability involving the image-processing software used by OpenAI’s community forum, which runs on Discourse. Specially crafted HEIC or HEIF images could exploit the vulnerability linked to the libheif image-decoding library. After Anthropic released Claude Opus 5, the researchers used the model to help generate and adapt exploit code for the target environment. They then combined the vulnerability with a separate OpenAI single sign-on issue. This combination allowed them to compromise ChatGPT and Codex accounts belonging to OpenAI employees. One compromised Codex account provided a route into OpenAI’s internal GitHub repository.

Access Without Inspecting Code

The researchers said they stopped further testing after confirming access to sensitive systems. Instead of examining OpenAI’s internal source code, they used an employee’s Codex account to submit a pull request to an internal repository as proof that the access worked. The repository, referred to as ‘Monorepo’, reportedly contains important algorithmic software, although the researchers did not inspect its contents.

OpenAI Fixed the Vulnerabilities

Hacktron reported the findings to OpenAI and Discourse. OpenAI fixed its identity-related vulnerability roughly 14 hours after receiving the report, while Discourse also addressed the image-processing issue. OpenAI later paid the researchers a $6,500 bug bounty for the reported vulnerability. The incident highlights the growing role of AI models in cybersecurity research, where tools such as Claude can accelerate the process of identifying and testing complex software vulnerabilities.

October 19, 2026
Autonomous AI in 2026: 6 Critical Security Risks Enterprises Need to Address

Autonomous AI is no longer a futuristic concept—it is actively handling workflows, making decisions, and using connected tools across the enterprise. But with greater autonomy comes a broader attack surface. As we move through 2026, security teams need to understand how these systems can be exploited, from hidden prompt manipulation to cascading system failures.

1. Prompt Injection Can Hijack AI Agents

Autonomous AI agents can encounter hidden instructions embedded in webpages, emails, PDFs, support tickets, or database records. Those instructions can manipulate an agent into changing its original task or disclosing sensitive information. The risk increases significantly when agents have access to browsers, cloud storage, email, or business APIs.

2. AI Agents Can Misuse Connected Tools

AI agents rely on APIs, databases, browsers, code tools, and business software to complete tasks. A compromised agent may exploit these legitimate tools or pass unsafe parameters, turning a simple prompt attack into unauthorized file access, data theft, system changes, or unexpected code execution.

3. Identity and Access Can Become a Weak Point

Agents increasingly operate under their own credentials or inherited permissions. When an agent is granted more access than it needs, attackers can use that identity to reach sensitive systems or perform unauthorized actions. Short-lived credentials, dedicated agent identities, and least-privilege access are essential safeguards.

4. Memory Poisoning Can Affect Future Decisions

Many autonomous agents maintain persistent memory, carrying information from one interaction into future tasks. Attackers may plant false instructions, fabricated data, or malicious context into memory stores. Once poisoned, that information can influence later decisions, making persistent memory a critical security boundary.

5. One Compromised Agent Can Trigger a Chain Reaction

Autonomous systems often connect multiple agents, tools, and workflows. A single manipulated agent can pass incorrect information or malicious instructions to other systems. These cascading failures can spread through connected workflows and create widespread operational damage without requiring every individual system to be compromised.

6. AI Supply Chains Create New Attack Surfaces

Autonomous AI depends on models, plugins, connectors, open-source packages, MCP servers, and other third-party components. A compromised dependency can introduce malicious behavior before the AI system reaches production. The International AI Safety Report also points to broader misuse and malfunction risks as AI capabilities grow and adoption expands.

To secure autonomous AI, organizations must treat these systems as high-risk extensions of the enterprise and apply strict controls across every interaction.

October 16, 2026
Building an Effective Cybersecurity Incident Response Plan: Key Steps and Best Practices

A cyber attack can escalate from a minor security alert into a full-blown business crisis within hours. A well-structured incident response plan equips every team with clear roles and actions before that crisis hits. The plan must cover detection, response, recovery, communication, and lessons learned from each event. It should also align with asset security, access control, backups, and overall risk management.

Understanding Modern Incident Response Frameworks

The National Institute of Standards and Technology (NIST) now treats incident response as an integral part of broader cybersecurity risk management through its Cybersecurity Framework 2.0. NIST SP 800-61 Rev. 3, published in April 2025, replaced the older 2012 guidance and integrates incident response with continuous improvement and risk-based decision-making.

Preparation: Before an Attack Occurs

A useful incident response plan starts with a clear inventory of critical systems and business services. Asset records should include servers, cloud resources, user accounts, data stores, network links, and third-party access. The plan must also prioritize which systems need the fastest recovery.

CISA recommends maintaining a full asset inventory, clear network maps, least-privilege access controls, and network segmentation. These measures limit the reach of an intrusion and help responders locate affected systems faster.

Define Roles and Responsibilities

Named roles are essential. The security team handles technical triage, IT isolates systems and restores services, legal staff assess notification obligations, and senior leaders approve major business decisions. A communications team prepares messages for staff, customers, and the public. External forensics or crisis management firms may be needed when internal resources are insufficient. Each role requires an owner, a backup contact, and a clear escalation path.

Backup Strategy

Backups require special attention. CISA calls for offline, encrypted backups with regular tests of access and integrity. Golden images can help restore key systems after a destructive attack. A backup that has never been tested in a real restore scenario cannot guarantee recovery during a crisis.

Detection and Containment

The 2026 Verizon Data Breach Investigations Report underscores the need for strong vulnerability management. Software vulnerability exploitation caused 31% of breaches, making it the top entry point for the first time in the report’s 19-year history. Ransomware appeared in 48% of breaches, while generative AI accelerated 15% of attack techniques.

An effective response plan defines actions after a security alert: confirm whether the alert indicates a real incident, identify affected accounts, devices, applications, and data, and preserve evidence before making major system changes. If an active threat remains, isolate affected hosts, restrict network paths, disable compromised accounts, revoke active sessions, and block known malicious access.

Ransomware requires a separate playbook. NIST IR 8374 Rev. 1 (June 2026) provides practical actions for ransomware risk under the Cybersecurity Framework 2.0, covering governance, asset identification, protection, detection, response, and recovery. CISA also advises prompt isolation of affected systems and careful recovery from clean offline backups.

Recovery and Post-Incident Review

Recovery does not end when a system comes back online. Teams must verify that the original attack path is closed, attacker access has ended, credentials have been changed where needed, and restored systems show no signs of compromise. Critical services should return first, with close monitoring before wider access resumes.

A strong plan includes a post-incident review that records the first known access, affected assets, attack path, response time, data exposure, control failures, and actions to prevent recurrence. NIST emphasizes continuous improvement, so lessons from one event should shape future security work.

Conclusion

An effective incident response plan is more than a document for the security team—it is a business control that connects technical action with leadership, legal obligations, communication, backup recovery, and risk decisions. The latest guidance from NIST and CISA, along with Verizon’s 2026 data, points to the same practical needs: clear roles, fast detection, strong isolation, tested recovery, and a plan that evolves after each serious incident.

Frequently Asked Questions

1. What is a cybersecurity incident response plan?

It is a structured plan that defines how an organization detects, investigates, contains, removes, and recovers from a cybersecurity incident.

2. Why does an incident response plan matter?

It gives teams clear responsibilities and defined actions, reducing confusion, limiting damage, and supporting faster recovery during a cyber attack.

3. What does NIST SP 800-61 Rev. 3 cover?

It provides current incident response guidance and connects response work with the Cybersecurity Framework 2.0 and continuous improvement.

4. How should a business prepare for ransomware?

Maintain offline, encrypted backups, test restoration, protect privileged accounts, isolate affected systems quickly, and maintain a dedicated ransomware response process.

5. How often should an incident response plan be tested?

The plan should undergo regular exercises and reviews so teams can identify weak points, improve procedures, and apply lessons from security incidents.

October 16, 2026
Bill Gates Urges Global Consideration of Slowing AI Development, Citing Risks of Rapid Change

In an exclusive interview with NDTV, Bill Gates has issued a striking caution about the pace of artificial intelligence development, suggesting the world should consider slowing AI’s advance to give societies more time to prepare for its profound implications.

Speaking to NDTV’s Vishnu Som, Gates described AI as fundamentally different from previous technological revolutions like the personal computer and the internet, which he helped shape during his time at Microsoft. He warned against assuming that AI’s impact would be as manageable as those earlier innovations.

“AI is a very unique technology,” Gates said. “I caution people who think it’ll be as easy to manage the impacts of AI as it’s been to manage other technologies.”

Calling AI “very profound,” Gates noted that the breadth and speed of its development have forced even someone with his long-standing belief in innovation to question whether the pace itself needs reevaluation. “If we could slow things down, I think we should consider that because of this need to get ready for such a rapid change,” he told NDTV.

The warning carries particular weight from a figure who has spent decades championing technological progress across computing, healthcare, agriculture, and global development. “Throughout my life, I have been a champion of innovation,” Gates said, referencing both his Microsoft years and the work of the Gates Foundation. “This is a rare case where innovation may be so broad and so dramatic that we’re not ready for it.”

The interview, tied to the Gates Foundation Goalkeepers Report, explores AI’s enormous potential in healthcare and development while also confronting the harder questions around its rapid evolution. At the heart of the conversation is whether societies, institutions, and regulatory systems can adapt fast enough to a technology whose capabilities are evolving at unprecedented speed.

Gates identified cybersecurity as one of the most immediate risks, warning that AI tools could significantly strengthen offensive cyberattack capabilities. “In the near term, there are cyberattacks where these AI tools will enable the offensive side,” he said, stressing that defensive capabilities must evolve just as rapidly.

He also addressed the deeper question of whether increasingly capable AI systems can remain under human control. Gates said he once viewed that concern as relatively distant, but recent developments have brought the issue closer to the present. “The idea of keeping the AIs under control, I have always thought of that as something fairly far out in the future,” he said, pointing to recent instances in reinforcement learning where AI systems displayed unexpected behavior. “Now this issue of keeping things under control, that’s there with the other challenges.”

Yet Gates’s assessment is not one of technological pessimism. He also underlined AI’s extraordinary potential and pointed to India as an important example of how the technology could be deployed rapidly for social and developmental benefit. “It’s a stunning set of capabilities,” Gates said, adding that India could demonstrate how “we can drive the good stuff as fast as possible.”

The conversation captures one of the central dilemmas of the emerging AI era: how to accelerate the benefits of a transformative technology without letting the speed of innovation outrun society’s ability to understand, regulate, and control it. For Gates, who has spent much of his life making the case for technological progress, the warning carries unusual weight. AI, he suggests, may represent a milestone when the question is no longer only how quickly innovation can move, but whether humanity is ready to move with it.

October 13, 2026
Axoflow Launches AxoDetect: In-Stream Sigma Detection Cuts SIEM Costs Without Sacrificing Visibility
Axoflow has launched AxoDetect, a detection component now in early access that runs security rules directly in the data pipeline. Announced during Splunk .conf26, AxoDetect applies Sigma rules in stream to clean, normalized security data before it reaches the SIEM, changing how organizations approach detection and log storage.

Detection before the SIEM ingest meter

AxoDetect is designed for detection engineers who need existing detections to fire earlier on cleaner data without paying SIEM ingestion rates for raw log volume. The platform runs customer rules in the pipeline, sends alerts to the SIEM, and stores full-fidelity logs in AxoLake, Axoflow’s low-cost security data lake that can also run on-premises.

The result makes the SIEM effectively optional as a log management system. Instead, the SIEM becomes a SecOps workflow engine for alerts and investigations, not a repository for an entire data estate.

Sigma rules in one open format

Detection engineers can write new Sigma rules, tune existing ones, and import community rules in one open format that works across tools. AxoDetect adds visibility that has historically been fragmented: what data is coming in, which detection each source feeds, and where a rule lacks the data it needs. That reduces the back-and-forth between detection and data teams that has typically been held together with manual processes and tool-switching.

Customer results
- A global industrial company cut SIEM costs by 50% and reduced mean time to resolution by 85%.
- A government agency reduced data volume by 80% and infrastructure footprint by 85%.
“The SIEM became the industry’s most expensive data swamp because it was the place where we kept all of our raw data,” said Balázs Scheidler, CEO and co-founder of Axoflow and creator of syslog-ng. “That constraint is gone. Detection belongs in the data layer, on normalized data, before the ingest meter starts. Keep your workflow in the SIEM. Send the alerts, but not your entire data estate.”

What’s next

Axoflow says the full detection lifecycle will run where the data lives, with additional capabilities rolling out in the months ahead.

About Axoflow

Axoflow describes itself as an autonomous security data layer for collecting, processing, routing, storing, and managing data, with in-stream detection now in early access. The company says its AI-based autonomy supports 10x faster investigations, 50% lower SIEM spend, and near-zero pipeline maintenance. Axoflow was founded by the creators of syslog-ng.
October 13, 2026
AI-Driven Threats Force Companies to Overhaul Their Network Defense Strategies

Artificial intelligence is transforming cybersecurity from both sides. Organizations now leverage AI to monitor activity, automate repetitive security tasks, and uncover patterns that are nearly impossible for humans to detect manually. At the same time, attackers harness the same technology to operate faster and at a larger scale. This dual impact is reshaping what businesses must defend, how quickly they need to react, and what skills their security teams require. Merely adding AI tools to an existing security framework is no longer enough; the entire strategy itself needs a fundamental redesign.

Security Operations Must Keep Pace with Automated Threats

As attacks become more rapid and automated, organizations need security operations that can identify unusual behavior without relying solely on manual review. Many companies now turn to managed cybersecurity services to provide continuous monitoring, threat detection, and incident response expertise that internal teams may struggle to maintain around the clock. This external support becomes especially valuable when internal IT departments are already stretched thin managing cloud systems, user accounts, software, devices, and daily technical issues. The ultimate objective is to establish enough visibility and response capability so that suspicious activity never sits unnoticed in a queue.

AI heightens the need for this capacity because attackers can use automation to conduct reconnaissance, test stolen credentials, generate persuasive phishing messages, and adjust their tactics in real time. No longer does an attacker have to manually execute every step of an intrusion to affect thousands of targets. Defenders must deploy systems that can process vast volumes of activity and help analysts prioritize what truly requires immediate action. Human judgment remains indispensable, but people increasingly depend on technology to filter and highlight the most critical signals.

Phishing Is Becoming Harder to Spot by Appearance Alone

For years, employees were taught to detect phishing by looking for awkward grammar, spelling mistakes, odd formatting, or phrasing that seemed off. Generative AI erodes many of those clues because attackers can now craft polished, professional emails tailored to a specific audience in seconds. They can also customize messages to target a particular role, industry, or situation using data gathered from public sources. A suspicious email may now look every bit as legitimate as a routine corporate communication.

This shift means organizations must move beyond training workers to recognize poorly written scams. Employees should learn to evaluate requests based on context, urgency, unusual payment instructions, unexpected credential demands, and changes to established procedures. Companies can also reduce reliance on human recognition by enforcing stronger authentication and verification steps for sensitive actions. An employee should never have to decide alone whether a convincing message from an executive requesting a major financial transfer is genuine.

Identity Is Becoming More Central Than the Traditional Network Perimeter

Companies have long concentrated on securing the boundary between their internal network and the outside world. That boundary has become increasingly blurred as employees use cloud applications, remote devices, mobile technology, third-party platforms, and systems that never reside inside a conventional corporate network. Attackers recognize that compromising a legitimate user account may be far easier than breaking through a technical barrier. Consequently, identity has emerged as one of the most valuable targets in modern cybersecurity.

AI amplifies identity-based attacks by helping cybercriminals generate convincing social-engineering messages or process stolen data at scale. Defensive strategies therefore now emphasize multifactor authentication, privileged-access controls, device trust, unusual-login detection, and limiting what each account can access. Companies should also routinely audit whether users still hold permissions they no longer need as roles evolve. A compromised account becomes far less damaging if it cannot reach systems that are not essential to its normal function.

Security Teams Need Help Distinguishing Signals from Noise

Modern organizations generate an overwhelming volume of security data. Firewalls, cloud platforms, identity systems, applications, endpoints, email servers, and countless other tools each produce alerts. The challenge is no longer about collecting more information; it is about understanding which combinations of activities indicate something genuinely suspicious.

AI can assist by correlating events and highlighting patterns that might be overlooked when each alert is examined in isolation. A login from an unfamiliar location may not be alarming on its own, and a large file download could have a plausible explanation. But when those events occur together on a privileged account shortly after a suspicious authentication attempt, the situation warrants immediate investigation. Context transforms individual datapoints into actionable insight.

However, organizations should remain cautious about assuming AI can eliminate false positives or make security decisions without human oversight. Automated systems can misinterpret legitimate behavior, and attackers may deliberately try to evade or manipulate detection mechanisms. The most effective approach combines AI-driven analysis with skilled human judgment to create a resilient and adaptive defense.

October 11, 2026
ApexGuard VPN in 2026: 7 Key Features That Determine Its Real Value

A paid VPN earns its value through consistent protection, practical controls, usable performance, and coverage across the devices people actually use. ApexGuard combines encryption, privacy architecture, leak protection, Double VPN routing, RAM-only servers, and unlimited-device support in one service. The most useful evaluation looks beyond a feature count and asks whether each capability solves a relevant problem for the user.

What a VPN Actually Does

A VPN encrypts the connection between a device and a remote server, then routes supported traffic through that server. Websites see the server’s public IP address instead of the user’s home, workplace, or mobile network address. This basic tunnel matters on public Wi-Fi, during travel, and when moving between networks. However, a subscription’s value also depends on data handling, leak prevention, network capacity, and device coverage.

1. Encryption and Protocols Still Set the Foundation

Encryption protects traffic between device and VPN server by turning it into ciphertext. This prevents connected networks from reading the data, though it does not hide signed-in accounts or replace HTTPS. ApexGuard uses AES-256 encryption with IKEv2/IPsec.

2. Privacy Depends on What Happens After Encryption

Encryption protects traffic in transit, but privacy also depends on what the provider logs. A no-logs architecture limits routine activity records. ApexGuard uses a strict no-logs policy, avoiding retention of browsing history, DNS requests, or traffic content. Its RAM-only servers use volatile memory instead of persistent storage.

3. A VPN Must Protect the Moments When It Fails

VPN connections can drop during Wi-Fi changes or sleep mode. A kill switch blocks unprotected traffic during interruptions, and leak protection addresses DNS, IP, and WebRTC leaks. ApexGuard combines these controls as part of the connection.

4. Network Infrastructure Determines Whether Security Feels Usable

Network capacity and server distance affect latency and throughput. ApexGuard offers locations in over 125 countries with 3.2 Tbps of total capacity. Its privately owned infrastructure gives direct control over routing and operations.

5. Device Coverage Changes the Economics of a Subscription

A VPN that covers unlimited devices under one account shifts the value equation. ApexGuard supports unlimited devices with apps for Windows, macOS, Android, and iOS, plus browser extensions for Chrome, Firefox, and Edge. Split Tunneling lets users direct specific traffic outside the VPN when needed.

6. Premium Features Need to Solve Real Problems

Features like Double VPN routing (sending traffic through two servers), Dedicated IP (reduces CAPTCHAs), Threat Protection (blocks malware and trackers), and Smart Play (streaming access) only matter if they address actual needs. Each should be evaluated against personal usage.

7. A Refund Period Is Part of Real-World Testing

VPN performance varies by location, device, and time of day. ApexGuard offers a 30-day risk-free period to test connection stability, speed, device compatibility, kill switch, and leak protection under normal conditions.

What Makes a Paid VPN Worth It in 2026?

A paid VPN is worth it when its privacy architecture, failure protection, infrastructure, and device coverage match real-world needs. Compare beyond feature counts and headline prices. Value comes from handling data responsibly, limiting exposure, performing reliably, and solving actual problems. For readers comparing VPNs in 2026, that approach is more reliable than a simple yes or no.

October 11, 2026
LG Smart TV Vulnerabilities: How Hackers Could Spy Through Your Microphone
Cybersecurity researchers have uncovered vulnerabilities in several LG smart TVs that could allow an attacker to access the built-in microphone, scan local networks, and potentially gather information about connected devices. The findings highlight the importance of reviewing smart TV security and privacy settings.

Why LG TVs Are Under Security Scrutiny

Investigations by Gamers Nexus, Level1Techs, and independent security researchers examined network activity, firmware behavior, and security weaknesses in LG’s webOS software. The researchers found that compromised TVs could identify devices on the same local network—including phones, computers, printers, and smart-home hardware—and detect nearby Wi-Fi networks. Remote-code-execution vulnerabilities were also reported, though full technical details remain undisclosed pending responsible disclosure.

Can a Hacked LG TV Listen to Conversations?

One of the most concerning findings is that a compromised TV can capture room audio even when the display appears to be off. Researchers demonstrated that audio could be stored while the TV remained offline and later transmitted when network connectivity returned. However, this does not mean every LG TV secretly records conversations—the demonstration involved a device already under an attacker’s control.

LG’s Response and Privacy Protections

LG issued a privacy statement on September 12, 2026, stating that its TVs do not continuously record or transmit conversations. Voice processing begins only after a supported wake word or remote button activation. For hands-free features, the TV monitors locally for the wake word and discards audio when none is detected. Some models also include a hardware microphone switch for manual disablement.

Automatic Content Recognition (ACR) and Tracking

LG smart TVs use Automatic Content Recognition (ACR) to create digital fingerprints of content, enabling personalized recommendations and advertising. LG states that ACR is activated only with user consent, and network scanning is described as a connectivity feature. Researchers also reported network-device discovery, which could reveal more about connected households.

How LG TV Owners Can Reduce Risk
- Install firmware updates promptly to patch known vulnerabilities.
- Review privacy and consent settings—disable ACR, personalized ads, and unused voice features.
- Place the TV on a separate guest or IoT network to limit access to other devices.
- Disable UPnP unless needed, and avoid exposing TV services to the public internet.
Should LG TV Owners Be Worried?

Current findings demonstrate a potential security scenario, not routine surveillance. Smart TVs deserve the same security attention as computers and smartphones. Keeping firmware updated and regularly reviewing privacy settings can significantly reduce risk.
October 10, 2026
WhatsApp Malware Campaign Uses Fake Invoices to Hijack Accounts

Cybersecurity firm Kaspersky has issued a warning about a rapidly spreading malware campaign on WhatsApp. Attackers are hijacking legitimate WhatsApp accounts and using them to send malicious attachments disguised as everyday business documents, such as invoices, billing statements, and payment notices.

The campaign has already impacted users in multiple countries, including India, Brazil, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, Vietnam, and Malaysia. Because the malicious files appear to come from known contacts, recipients are far more likely to open them without suspicion.

How the Scam Works

According to Kaspersky researcher Fareed Radzi, the attackers exploit trust within messaging platforms by using compromised accounts to deliver malicious attachments that appear to originate from familiar people. The files are VBScript attachments carefully named to resemble financial reports and account notices.

Once a victim opens the file, it triggers a staged infection chain that quietly downloads and executes additional harmful components from external servers. In many cases, this ultimately installs a remote access tool, granting attackers control over the infected device without the user’s knowledge.

Safety Recommendations

Kaspersky advises users to treat unexpected attachments with caution, even when they come from known contacts. Specifically, avoid opening script or executable files such as VBS, EXE, BAT, and JS unless their legitimacy is confirmed.

India’s Cyber Crime Coordination Centre has also issued a similar alert, noting that fraudsters often name these files “View Details” or “Invoice” to appear genuine. Officials recommend verifying any unexpected document with the sender directly, preferably through a phone call, before opening it. A single click can compromise an entire WhatsApp account and its contact list.

Stay vigilant and always double-check the unexpected, even if it comes from a trusted name.

October 9, 2026
Agentic AI in Indian Banking: From Chatbots to Autonomous Decision-Making

Artificial intelligence in Indian banking has largely meant chatbots that answer balance queries, recommendation engines that suggest the next product, and fraud models that flag suspicious transactions for a human to review. That era is ending quickly. What is emerging now is agentic AI: a class of systems that does not just respond to a prompt, but plans, decides and acts across multiple steps without waiting for a human to approve each move.

The shift is not cosmetic. It changes how credit gets underwritten, how KYC gets verified, how fraud gets stopped, and how service teams spend their day. The numbers behind it are large enough to demand attention. The operational details are messy enough to demand caution.

From Prompt-Response to Plan-and-Act

Traditional automation in banking, including robotic process automation and early generative AI tools, worked on a simple pattern: a human triggers a task, the system executes a fixed script, and the output goes back to a human for the next step. Agentic AI breaks that pattern. An agent is given a goal—something like “resolve this customer dispute” or “underwrite this loan application”—and then independently queries APIs, pulls data from multiple systems, applies reasoning and takes the next action, often chaining several steps together before a human ever sees the result.

This matters technically because RPA breaks the moment an interface or a data format changes. Agentic systems, built on reasoning loops that plan, act and adjust based on outcomes, can handle edge cases a rules-based script cannot. That flexibility is precisely why banks are willing to give these systems more autonomy, and precisely why the risk profile looks different from anything that came before.

The global market for agentic AI in financial services is estimated at close to $7.8 billion in 2026, up from around $5.5 billion a year ago, on a path toward more than $43 billion by 2031. That implies a compound annual growth rate above 41 percent. Even accounting for the usual noise in market-sizing reports, growth at that scale signals genuine capital commitment rather than marketing enthusiasm.

More telling than the headline number is the adoption curve inside institutions. Around 44 percent of financial services teams report actively using agentic AI in 2026, several hundred percentage points higher than early 2025. Among the largest global banks, more than seven in ten now have programs that have moved past proof-of-concept into production or advanced piloting. Fintechs and neobanks, unburdened by decades-old core banking systems, are moving faster still. A parallel market has emerged around governance: platforms that monitor, audit and constrain what autonomous agents are allowed to do are already valued near $9 billion in 2026 and expected to cross $14 billion within five years. That the oversight layer is growing almost as fast as the core technology tells you banks understand autonomy without control is not a viable strategy in a regulated industry.

Where Agentic AI Is Actually Being Used

Fraud detection and anti-money laundering account for the largest functional share of agentic deployments, roughly a third of all use cases by some estimates. Fraud patterns shift constantly, transaction volumes are enormous, and the cost of a missed signal is high. Agents that correlate cross-border transaction patterns, flag anomalies and take a first action such as placing a temporary hold offer a meaningful edge over static rule engines.

Credit underwriting has moved from experimental to operational. Rather than a loan officer manually pulling GST filings, bank statements and alternate data sources, an agent queries multiple verification APIs in parallel and produces a draft underwriting memo within seconds. The human role shifts from gathering data to reviewing a structured recommendation.

Onboarding and KYC verification follow a similar pattern. Multi-agent architectures orchestrate biometric de-duplication, registry lookups against systems like CKYC, and fraud checks simultaneously instead of sequentially, cutting what used to take hours down to near real time. For insurers, agentic workflows validate first-notice-of-loss claims, cross-check damage documentation and trigger payouts on small claims without human intervention.

This is no longer confined to individual institutions. NPCI is developing a Unified Agent Protocol that would let verified AI agents execute UPI payments without the user approving every transaction, having already piloted agentic payments publicly at the last Global Fintech Fest. When the country’s payment rails are themselves being redesigned for agents, the question for banks is not whether to participate but how quickly they can be ready.

Across these use cases, institutions report autonomous resolution rates exceeding 80 percent for structured tasks such as dispute triage and routine compliance checks. That is a real productivity gain, but it carries a specific risk. When 80 percent of the easy work disappears, what remains is disproportionately the hard, ambiguous and emotionally charged work that agents are not yet trusted to handle alone. Support staff are left with an inbox of complex disputes and fraud complaints from customers who have already been through an automated flow that failed them. Industry estimates put the AI and data skills gap inside BFSI global capability centres at around 42 percent, meaning a significant share of the workforce lacks the combination of financial domain knowledge and technical fluency these systems demand.

The Design Problem Hiding Inside the Technology Problem

Most of this conversation treats agentic AI as an engineering problem. It is at least as much a design problem. Autonomy only creates value if a customer can understand what an agent is about to do on their behalf, and a supervisor can see why it did what it did. That is interface work: consent screens that make agent permissions legible rather than buried inside a mandate flow, explanations that surface the two or three factors behind a credit decision instead of a confidence score, and override controls that are obvious under pressure rather than three taps deep.

In Indian retail banking, where a large share of users transact in a second language on an entry-level device, this is not polish. It is the difference between an agent people trust with a payment and one they switch off. Banks that ship autonomy without designing the visible layer around it will find adoption stalling for reasons no amount of model retraining can fix.

Security and Governance Cannot Be an Afterthought

Giving an autonomous agent the ability to query core banking systems, move funds or freeze accounts introduces a new category of cybersecurity concern. Agent permissioning, meaning precisely defining what each agent may do and rate-limiting how often it can act, is now a primary vulnerability that did not exist in the same form when humans initiated every transaction. Meanwhile fraud itself is becoming more sophisticated, with a large share of advanced attempts involving generative AI or synthetic voice, pushing banks to deploy defensive agents that evaluate behavioural biometrics and liveness signals in real time.

Regulators in India have been explicit that autonomy does not remove accountability. Under SEBI’s updated Cybersecurity and Cyber Resilience Framework, regulated entities such as brokers, asset managers and depositories remain directly liable for the actions of their AI systems, closing off any defence built around blaming the algorithm. The Reserve Bank of India has taken a similarly clear position that high-stakes decisions, including credit rejections, loan restructuring and account closures, must retain a human in the loop and remain explainable, even as agentic systems handle the surrounding workflow. India’s data protection framework adds another layer, requiring that every autonomous action, data query and API call an agent makes be logged into an auditable trail a human can review after the fact.

Agentic AI in BFSI is not a distant trend. It is already running fraud checks, assembling credit memos and triaging disputes inside real institutions today, and it is moving into the payment rails themselves. The technology has proven it can compress work that used to take hours into seconds. What remains unresolved is whether BFSI organizations can build the governance, workforce readiness and design discipline to match the pace of deployment.

The institutions that get this right will be the ones treating agentic AI as a governance, people and design problem as much as a technology problem, measuring success not by how much work an agent completes on its own, but by how well the humans on both sides of it—customers and supervisors alike—can understand, correct and take responsibility for what it does.

October 8, 2026