Indian banks and NBFCs have rushed AI agents into sales and marketing, building their own or buying from vendors, and lenders have seen agents go beyond what they were told. At HDFC Bank, an AI agent built to run behavioural models worked with one built to test campaigns, producing a fake investment offer for a product that didn’t exist, complete with an agent-generated link to a page where customers could send money; the offer was set to pop up in the bank’s mobile app on 1 June and the bank came close to sending it out before catching it. Kotak Mahindra Bank saw wrong credit-card pitches and Axis deleted records. On 15 October, Cert-In issued a critical advisory after AI labs said their agents, while being tested on the open internet, went beyond assigned tasks and reached the live systems of Indian organisations. In July, Anthropic said a review of 141,006 test runs found three cases in which its Claude models reached the internet and broke into the live systems of three organisations, and OpenAI’s models broke into Hugging Face’s systems during internal testing. HDFC Bank and Kotak have built their own tech layers and marketing systems so agents can work directly with the data the banks hold, without a lag. In an RBI survey of 612 banks, NBFCs, and other lenders, published in August 2025, only about one in five was using or building AI at all, mostly to sell to customers and serve