Critically examine how autonomous AI agents pose stealth threats to Critical Information Infrastructure (CII). Why is attribution uniquely challenging in agent-led cyber intrusions?

Autonomous AI agents transform cyberattacks from scripted events into adaptive, self-directed campaigns. For CII, whose disruption can affect lives, security and national security, the danger lies not in speed but in stealth, scale and accountability. How the threat operates

• Reconnaissance and exploitation: Agents scan code, map networks and generate exploits at machine speed. AI-identified vulnerabilities show a higher remote-code-execution rate (50%) than the wider CVE ecosystem (26%).
• Evasion: Just-in-time malware generation produces polymorphic code, defeating signatures and changing behaviour during execution. PROMPTFLUX and PROMPTSTEAL illustrate this model.
• Social engineering: Personalised phishing, deepfakes and convincing pretexts target operators, developers and privileged administrators, often bypassing technical controls.
• Autonomy and scale: Agents can choose targets, re-task themselves, harvest credentials and move laterally with limited oversight. They also threaten AI supply chains by stealing API keys, poisoning repositories or misusing cloud resources.

Why attribution is harder

1. AI can imitate another actor’s tools, language, timing and TTPs, while rapidly rewriting code and erasing operational fingerprints.
2. Agents collaborate across jurisdictions and infrastructure, with dynamic tasking and unreliable metadata. Existing CVE and incident systems rarely record AI involvement uniformly, increasing dependence on imperfect heuristics.
3. Logs may identify a model, server or compromised account, not the human who instructed, trained or merely failed to control it. Thus forensic attribution does not automatically establish intent, responsibility or state sponsorship.

India needs continuous validation alongside NCIIPC, CERT-In reporting, protected-system rules and sectoral exercises. Proportionate safeguards must preserve innovation, require human control and ensure accountable, resilient essential services globally.