India’s digital public infrastructure suffers from a security paradox. While newer stacks like DigiYatra as well as UPI are secure by design, with authentication and auditability integrated into their core architecture, many are finding legacy government websites exposed at the edges.
Over the past two months, young ethical hackers have exposed vulnerabilities in CBSE, NEET, and JEE portals.
Nineteen-year-old ethical hacker Nisarga Adhikary recently exposed critical security flaws in the CBSE On-Screen Marking portal by finding a hardcoded master password and bypassing client-side OTP validations. He found unsecured AWS storage buckets containing millions of student answer sheets and credentials.
Meanwhile, 16-year-old Dubai-based student cybersecurity researcher Rylen Anil ethically hacked the JEE Advanced portal and found a temporary cloud storage misconfiguration that exposed approximately 179,600 candidate result records and 187,300 admit-card PDFs. He also identified weak login checks in the NEET portal that could expose confidential data of exam observers and centre coordinators.
"Portals like CBSE and JEE represent a dangerous combination—highly sensitive data with chronically weak security," Koushik Pal, Threat Researcher at predictive cyber threat intelligence company CloudSEK, tells AIM. These student records are linked with Aadhaar, exposing students’ contact details and even financial information.
Now, AI software like Anthropic’s Claude Mythos threatens to expose even more security lapses. According to findings of a team of experts from IIT Kanpur and IIT Madras, AI tools including Claude were used to detect weaknesses that enabled access to parts of the CBSE-linked portal.
"Technically, outdated software, unpatched systems, and basic vulnerabilities like SQL injection remain exploitable entry points," Pal observes.
"Peak traffic windows—result days and registration deadlines—are deliberately exploited to either cripple access or mask simultaneous intrusions. Critically, most portals operate without dedicated cybersecurity teams or real-time threat monitoring, leaving them reactive rather than prepared," he mentions.
Sometimes, It’s Just Bad Code
Beyond security vulnerabilities, many government websites lack basic input sanitisation and run on unpatched content management systems, leaving forms vulnerable to SQL injection and cross-site scripting attacks.
Tanmay Bakshi, a Canadian prodigy and IBM AI engineer, recently came across an example of such clunky software when submitting an Indian visa application. He tells AIM that what stood out was not the absence of cutting-edge technology but the evidence of surprisingly basic software flaws.
"It wasn't any sort of major challenge. It was a lot of really simple things that I'm sure people who built the website would have experienced themselves if they tried to actually go through the thing," Bakshi mentions.
One issue emerged during the document upload stage. The portal required applicants to upload multiple supporting documents across different rows. But selecting files for more than one row before clicking upload caused the entire application to fail without warning.
"If you select the files for multiple rows and then click the upload document, the whole thing breaks, the form dies, you've got to redo the whole thing, and it doesn't tell you why," he states.
The engineer decided to investigate. He opened the website's source code, and what he found was a surprisingly elementary programming mistake. “That's when I discovered they had the same identifiers for different form elements. The workaround was to upload each document individually."
The episode illustrates a larger problem with how many public digital services are built—not a lack of AI or advanced engineering, but insufficient quality assurance and a user testing failure.
"These are very, very simple mistakes in the code—mistakes that I'm 100% sure the developers could have found and fixed. They probably just didn't have the resources or the incentive to do the testing necessary or to empathise with the users."
Agentic AI changes that equation. AI coding assistants can flag common programming mistakes, automate quality assurance, generate test cases, and simulate thousands of user interactions long before a website goes live. But technology alone is not enough.
The larger challenge, Bakshi says, is cultural. “Government leaders and project owners need to stop measuring success by whether a portal has been launched and start evaluating whether citizens can actually use it without frustration,” he notes.
AI Can Overhaul Digital Public Services
While AI-powered quality assurance can dramatically improve testing of government websites without requiring large manual QA teams, simply introducing AI tools will not solve systemic issues if organisations continue treating software delivery as a box-ticking exercise.
"Applying more agentic AI technology is still just a patch over the real problem," Bakshi remarks.
Instead, he believes leadership must fundamentally rethink how digital public services are evaluated.
"The leadership needs to care more about the products being delivered," he adds.He observed that many executives rarely experience the software their organisations build because they delegate those tasks to others.
For government services, where millions of citizens depend on digital portals for visas, taxes, healthcare and transportation, this disconnect becomes even more consequential.
Despite the shortcomings, Bakshi remains optimistic that public services will be transformed by AI. "I'm certain that agentic AI is going to improve a lot of government services."
In fact, he believes some government platforms are already beginning to reflect better software engineering practices. "The health declaration form I filled when entering India was probably the smoothest form experience I've had. I'd be willing to bet there was some Claude or Codex involvement in designing it," he speculates.
Cybersecurity Opportunities
The problem extends beyond isolated website outages. As government services become increasingly digitised, vulnerabilities in public-facing systems could expose millions of citizens' personal information while disrupting essential services.
"AI fundamentally shifts government cybersecurity from reactive damage control to proactive defence," Pal states.
He explains that AI can scan dark web forums and underground hacker communities for leaked government credentials or discussions about planned attacks, allowing agencies to respond before breaches become public.
Beyond external threats, AI can also identify suspicious behaviour within government systems.
Traffic surges during examination registrations, tax filing deadlines, or result announcements also present a major challenge for government websites. AI can distinguish genuine users from malicious bot traffic in real time, helping maintain service availability during periods of peak demand.
"During high-traffic windows, AI distinguishes millions of real users from bot-driven attacks in real time," Pal notes.
For many government departments that struggle with limited cybersecurity manpower, AI can also serve as a force multiplier. "For understaffed government security teams, AI automates alert triage and incident response—effectively multiplying analyst capacity without proportional budget increases."
The government appears to be taking notice. The Indian Computer Emergency Response Team (CERT-In) has operationalised an AI-powered war room to proactively monitor and secure government websites. It aims to identify vulnerabilities, modernise legacy portals, improve website performance and user experience, and build cybersecurity capabilities across ministries and departments.
Your reaction