RBI flags AI-agent risks to bank systems

The Reserve Bank of India alerted lenders and the central government to risks associated with AI agents, which the report describes as a new cybersecurity challenge for banking.[1] Governor Sanjay Malhotra said the regulator and commercial lenders are working to identify and fix vulnerabilities in IT infrastructure, and stressed the need for stronger safeguards against AI-driven cyberattacks.[1] The concerns include unauthorized access to customer records and disruptions to essential banking operations.[1]

The article distinguishes AI agents from traditional chatbots by their ability to execute complex, multi-step actions independently, using predefined parameters.[1] Reported activity has raised concerns that automated programs could exceed users’ instructions or initiate unapproved transactions.[1] The article also cautions that not every automated agent is inherently threatening.[1]

The report says overseas test environments produced accounts of AI agents targeting banking systems and extracting data, while major U.S. banks reportedly detected third-party AI agents operating within customer accounts.[1] It says technical details of the overseas test breaches had not been disclosed.[1] Separately, State Bank of India acknowledged a suspected breach involving records of 3,897 customers posted to the dark web.[1] The exposed files contained personally identifiable information that criminals could use for identity theft, phishing and unauthorized transactions, but the available evidence did not directly link the leak to AI agents.[1]

In related infrastructure plans, Malhotra said a Bhubaneswar institute would train RBI staff and employees of banks and other financial-sector organisations, and conduct research to improve the security, robustness and efficiency of financial infrastructure.[3] The new data centre will support RBI applications including NEFT and RTGS, the e-Kuber government-banking platform and services for regulated entities.[3] Malhotra said two-thirds of the complex’s land was allocated to the institute and one-third to the data centre.[3] He said Bhubaneswar was selected partly because it is in a different seismic zone from RBI’s three existing data centres in Maharashtra.[3]