India Sets Audit Rules for AI Agents as AI-Assisted Hackers Hit Fintechs and Crypto Exchanges

India's national cyber agency has published audit rules for AI systems that plan and act on their own. In the same week it named a hacking group that uses AI tools to break into lenders, fintechs and crypto exchanges "at machine speed." For Pakistan's digital-asset sector, both stories are a warning.

On 4 November 2026 the Indian Computer Emergency Response Team (CERT-In), which works under India's Ministry of Electronics and Information Technology, released the AI Security Auditing Guidelines: Framework for Secure, Ethical, and Auditable Artificial Intelligence Systems (version 1.0).

The framework is risk-based. It sets out nine core audit domains, running from governance and the data lifecycle to third-party supply-chain assurance, and grades findings at four severity levels: Critical, High, Moderate and Low/Observation. It covers AI systems that organisations in India build, buy, deploy or run, and also systems that process Indian data or serve Indian users.

The document singles out agentic AI: systems that can plan and carry out tasks on their own, use external tools and hand work to other AI systems. A conventional chatbot answers a prompt. An agent can take several steps to finish a job, and along the way it can pull in information, run software, execute code and talk to outside systems.

CERT-In names three features that raise the risk. The first is autonomous task execution, where the agent acts without a human approving each step. The second is persistent memory, where the agent keeps information from earlier conversations and tasks. The third is delegation, where the agent can pass work to other agents.

Auditors are asked to test whether an agent can go beyond the permissions it was given, use tools without approval, get around approval steps or misuse credentials. They should also check for unsafe delegation of tasks, test whether emergency-stop mechanisms actually work, and look at the risks in what an agent remembers from earlier tasks.

The timing matters. The same week, CERT-In issued a critical advisory, CIAD-2026-0058, about a group it calls "Crafty Falcon." According to the advisory as reported by Reuters and The Hindu, the group has breached non-bank lenders, fintech firms and cryptocurrency exchanges.

CERT-In says the attackers use publicly available AI tools to automate break-ins "at machine speed." It named four tools: ARTEX, PentAGI, Cairn and CyberStrikeAI. Reuters reported that at least two of them are linked to China. That link comes from Reuters' reporting, not from CERT-In, which has not said who is behind the group.

Taken together, the two documents describe the problem from both sides. The autonomy that makes AI agents useful to a bank also makes them useful to an attacker. And an agent with too many permissions inside a company is a ready-made target.

CERT-In is not the only body working on this. In February 2026 a post on the Cloud Security Alliance blog set out the Agentic Trust Framework (ATF). It is an open specification, written by Josh Woodruff of MassiveScale.AI, that applies zero-trust principles to AI agents. Its starting point is: "No AI agent should be trusted by default, regardless of purpose or claimed capability."

ATF asks five questions of every agent. Identity: who are you? Behaviour: what are you doing? Data governance: what are you taking in, and what are you putting out? Segmentation: where can you go? Incident response: what if you go rogue?

Its central idea is that an agent has to earn autonomy. It starts as an "Intern" that only observes. It moves up to "Junior," which recommends actions that a human approves, then "Senior," which acts and notifies a human afterwards, and finally "Principal," which works on its own within a set domain. To move up a level it has to pass five gates: performance, security validation, business value, a clean incident record and governance sign-off. Any significant incident drops it back down.

The framework comes from a vendor and was published on the CSA blog. It is not a regulation. But it points the same way as CERT-In: every agent needs its own identity, limited permissions, logs of what it does, and a kill switch that works.

What does this mean for Pakistan? Pakistan's digital-asset sector is growing fast, and the people building it are adopting AI just as quickly. Exchanges, wallet providers, payment firms and banks all use it, for customer support, fraud screening, KYC review and, more and more, for agents that can act on systems. Three lessons from India apply directly.

First, crypto exchanges are now named targets. Crafty Falcon went after exchanges and fintechs, the kind of firms now preparing to operate under Pakistan's new digital-asset regime. An attacker that automates a break-in does not care about borders. If tools like PentAGI and CyberStrikeAI are publicly available, they are available to attackers targeting Pakistani firms too.

Second, audits need to cover what agents can do, not just what they say. Most AI reviews today check outputs for accuracy and bias. CERT-In's list sets a tougher bar: permissions, credentials, approval bypass, delegation, memory and emergency stop. Pakistani firms that put agents near payment or custody systems should test these now, before a regulator or an attacker does it for them.

Third, firms serving Indian users are in scope. The guidelines reach systems that serve Indian users or process Indian data. Pakistani fintech and software exporters with clients across the border should check whether that applies to them.

A practical starting point for any Pakistani exchange or fintech using AI agents: give every agent its own identity and credentials, never a shared admin key; keep agents read-only or "recommend only" until they have a track record; log every action an agent takes, with a named human owner; set hard transaction and rate limits on anything an agent can touch; and test that the kill switch works before the agent goes live.

India has now written down what an audit of an AI agent should look like. Pakistan's regulators and industry can adopt that standard early, or adopt it after the first incident.