By Anand Jude Kannabiran, Vice President – Asia, Delinea
India has been leading the AI agent adoption wave from the front. Microsoft’s Work Trend Index found that 93% of Indian business leaders plan to deploy AI agents within the next 18 months, and EY’s survey shows 24% of leaders are already deploying agentic AI, with deployment speed now the deciding factor in buy-versus-build decisions. That speed is exactly what attackers are banking on.
As more Indian enterprises put AI agents into production across banking, retail, and IT services, bad actors are combining multiple techniques to exploit vulnerabilities in these agents and the systems they depend on i.e. connectors, tool integrations, and model-context protocols (MCPs). This mirrors how traditional software supply-chain attacks evolved: compromise one trusted, widely used component, and you gain access to many others. AI agents are fertile ground because they hold credentials, call tools, inherit permissions, and act across systems autonomously and with broad access.
Here are some techniques we are seeing, and how they chain together:
Agent hijacking (prompt injection): An attacker hides malicious instructions inside unstructured content like an email, a web form, a support ticket in order to override the agent’s actual mission. Picture a customer support agent at an Indian NBFC processing an email complaint that contains invisible text instructing it to redirect all future correspondence to an external inbox. This is almost always the opening move. To defend against this, stop treating unstructured natural language as executable instruction, cap autonomous loops, and require a validation checkpoint before the agent commits to a new goal or consequential action.
Jail breaking: Instead of hiding instructions, the attacker takes the agent out of its safety constraints. An attacker might convince an internal assistant at a BFSI institution it’s part of a “mandated, isolated compliance audit role-play” to bypass guardrails, a framing that lands easily given how seriously Indian financial institutions treat audit and compliance language. To defend against this, disconnect safety monitoring from the main agent’s context window, and check every final action against original intent and policy before it executes.
Identity and privilege abuse: Agents authenticate using API keys, tokens, and secrets. Steal those, and an attacker has durable access given how many Indian enterprises still grant agents static, long-lived credentials rather than scoped, short-lived ones. To avoid this, replace raw static credentials with just-in-time tokens and dedicated service accounts.
Privilege inheritance exploitation: Many agents carry permissions far broader than their task requires, letting a low-value agent reach high-value systems. A marketing agent cleared to read customer data for a seasonal campaign might inherit broad drive access that an attacker could use to wipe strategic plans or competitor research. To prevent this, scope permissions to the task, not the service account, and put human-in-the-loop approval on any high-impact action.
Autonomous lateral movement: A compromised agent uses its own tooling to move across systems on its own. A hijacked scheduling agent could slip a payload into meeting notes read by an internal IT-support agent, which then uses its admin access to push ransomware network-wide. To defend against this, there should be zero trust between agents, sign and verify agent-to-agent messages, and segmented environments. It’s also important to watch for unusual cross-system call chains and be ready to revoke tokens in seconds.
This is no longer a theoretical concern for Indian boards. The RBI’s FREE-AI framework, released in 2025, now expects board-approved AI policies and institutional AI inventories from regulated entities by the end of this financial year, and explicitly requires cybersecurity frameworks to extend to AI-specific risks like adversarial attacks, with standardised AI incident reporting. Layer that against the DPDP Act’s data-processing obligations, and Indian enterprises face a governance stack where agent security becomes a compliance requirement, not just an optional infrastructure.
The good news is that none of this is entirely new. India has spent two decades building privileged access discipline for human and machine identities in banking and IT services. The task now is applying that same discipline to AI agents and to everything plugged into them.