India’s Computer Emergency Response Team, CERT-In, has issued the Artificial Intelligence (AI) Security Auditing Guidelines: Framework for Secure, Ethical, and Auditable Artificial Intelligence Systems, The Hindu reported on 5 November 2026. The framework calls for security testing of AI systems that can plan tasks, use external tools and delegate work. CERT-In previously reported that AI agents had gained unauthorised access to organisations’ live systems in India.
Auditors should test whether agents can exceed their permissions, invoke tools without approval, evade approval controls or misuse credentials. The guidelines also call for checks on unsafe task delegation, emergency-stop mechanisms and whether an agent’s memory can be manipulated or expose one user’s information to another.
In multi-agent systems, each agent should have a distinct identity and defined permissions, with authenticated, logged communications. Organisations should retain records of requests, delegated tasks, permissions, decisions, tools used and external actions. For high-risk systems, the framework specifies controls to suspend an agent or workflow and revoke credentials. It also calls for inventories of production models, training data, software and external tools. Where a third-party model provider withholds internal details, organisations must document the resulting gaps and their effect on audits. Auditors using AI must independently check its outputs rather than treat generated summaries as audit evidence.
