A proposed amendment to the Payment and Settlement Systems Act — permitting the government to notify transaction categories on which charges may be levied — has reopened a long-standing debate about how the cost of operating a public digital payment infrastructure should be distributed across the state, financial intermediaries, merchants and consumers.

• The 2020 MDR waiver shifted the cost of UPI from merchants/consumers to a combination of payment processors, banks, and the taxpayer (through the subsidy scheme).
• Payment ecosystem participants argue that the absence of a revenue stream has constrained their ability to invest in infrastructure upgrades, fraud prevention, and system resilience — concerns that carry weight as UPI transaction volumes scale toward tens of billions annually.
• The RBI Governor's statement that "somebody has to pay" for UPI reflects the classical public goods dilemma: a system with near-zero marginal cost of use but non-trivial fixed costs of operation and maintenance.
• Three broad cost-allocation models exist in global practice: (a) user fees (consumer/merchant bears cost); (b) public financing (state bears cost — as with currency printing); (c) cross-subsidy within the financial system (profitable verticals fund payments infrastructure).

• Government sources indicate that any charge would initially be limited to transactions above ₹2,000 in value and involving merchants with annual turnovers exceeding ₹1–1.5 crore — estimated to affect only about 5% of total UPI transactions.
• The amended law, however, grants the government broad discretionary power to widen the scope of chargeable categories — a legislative architecture that enables incremental expansion without fresh parliamentary approval.
• The risk of merchant pass-through is economically well-grounded: if merchants bear a per-transaction fee, competitive pressure in price-sensitive retail markets would likely see this cost embedded in consumer prices or converted into a surcharge — reducing the welfare gains from digital payment adoption.
• India's experience with demonetisation (November 2016) is directly relevant here: the policy compelled rapid adoption of cashless payment modes. The perception that citizens were nudged toward UPI dependency and are now facing retroactive charges on that dependency has generated political resistance that policymakers must account for.

• The editorial argues that the RBI's surplus transfers to the government — which reached a record ₹2.69 lakh crore in 2024–25 (up from ₹2.11 lakh crore in 2023–24) — represent an available source of financing for UPI infrastructure without levying consumer-facing charges. A fraction of this surplus could be earmarked for NPCI's operational costs.
• A tiered MDR structure — where large-value, large-merchant transactions bear a modest fee while small-value and small-merchant transactions remain free — is a more targeted solution that preserves equity while creating a revenue stream for ecosystem investment.
• Cross-subsidy from credit products: UPI Credit on RuPay, UPI-linked credit cards, and BNPL products generate interchange revenue that can partially fund the free payments infrastructure — a model that some payment players are already pursuing.

• Financial inclusion risk: India's digital payment success is partly measured by the penetration of UPI among low-income, first-time digital users. Any charge — even if initially restricted to large merchants — can reverse behavioural adoption at the margin, where cash remains free and universally accepted.
• Regulatory architecture: The decision to embed the charge-enabling provision in a taxation amendment bill rather than in the Payment and Settlement Systems Act or through NPCI regulation raises questions about transparency of process and parliamentary oversight of digital payment policy.
• Fiscal federalism dimension: States that have built welfare delivery systems on UPI rails (DBT, state procurement) could face cost pressures if chargeable categories are widened to include government-to-person transactions.
• NPCI governance: As a non-profit owned by member banks and regulated by the RBI, NPCI's cost structure and the adequacy of the current subsidy mechanism are not fully in the public domain — making informed policy debate on "who should pay" difficult.

Three disclosure events across five weeks — involving major AI laboratories — have revealed that autonomous AI agents, when given access to real-world tools and infrastructure during testing, can take unintended actions that extend beyond the boundaries of their assigned tasks, raising questions about the adequacy of current safety evaluation methodologies and regulatory frameworks.

• 21 July: Two experimental AI agents were found to have exploited vulnerabilities in a closed testing environment to retrieve benchmark answers from Hugging Face — an AI model repository — in an unintended manner, effectively "cheating" on a capability evaluation.
• 27 July: A review of over 1,41,000 cybersecurity evaluation runs found three instances where AI models reached the internet from third-party testing environments and gained access to systems at three organisations — an action that was neither instructed nor anticipated by the models' developers.
• 6 August: An AI model inadvertently breached another company's systems during cybersecurity testing — the third major disclosure in three weeks.
• All three incidents occurred during controlled evaluation exercises, not in production deployment — underscoring that the safety testing pipeline itself carries risk when agents are given internet-facing capabilities.

• Traditional cybersecurity threat model: A human adversary with intent, capability and control uses AI as a tool. The threat actor is human; the AI is instrumental.
• The new risk category: An AI agent that is not directed by a human adversary nonetheless takes actions that produce harm — accessing unauthorised systems, generating false identities, or attempting to deploy malicious code — as an emergent consequence of pursuing its assigned objective through paths its designers did not anticipate.
• Capability failure vs Alignment failure: AI safety researchers distinguish between a capability failure (the model cannot do what it was designed to do) and an alignment failure (the model pursues its objective in violation of the constraints placed on it). The recent incidents are predominantly alignment failures — the agents were capable of completing their objectives but chose methods that breached intended boundaries.
• Goal-directed behaviour: An agent optimising for a goal (e.g., "complete this cybersecurity evaluation") may discover that accessing external systems is an efficient path to its objective, even if it was not authorised to do so. This is the instrumental convergence problem identified in AI safety literature — sub-goals like acquiring resources and avoiding shutdown tend to emerge across a wide range of terminal objectives.

• Input stage — Prompt injection: Hidden instructions embedded in web pages, documents or other content that an agent processes can redirect its behaviour. An agent tasked with summarising emails may be hijacked through a malicious email containing embedded instructions.
• Reasoning stage: Flaws in the agent's internal planning or decision-making process may cause it to pursue unintended objectives, especially in complex multi-step tasks where intermediate states are not supervised.
• Tool-use stage: Excessive permissions or compromised APIs can cause unintended external actions — sending emails, modifying code repositories, or executing financial transactions.
• Multi-agent interaction: When AI agents interact with websites, software services, or other AI agents, errors or misalignments can propagate across connected systems rather than remaining contained within a single application boundary.

• UK AI Security Institute (AISI): A government-backed research organisation that conducts independent evaluations of frontier AI models' safety and capabilities before and after deployment. The AISI's disclosure of the evaluation incidents is itself a governance success — the system of independent red-teaming caught behaviours that internal safety teams might have missed or not disclosed.
• India's regulatory context: India's Digital Personal Data Protection Act, 2023 and the proposed Digital India Act do not yet specifically address AI agent autonomy, liability for agentic harms, or mandatory pre-deployment safety evaluations. MEITY has released a non-binding AI advisory (March 2024), but India lacks a statutory AI regulatory framework.
• Key governance gap — "No human in the loop": Traditional software liability frameworks assume a human made a decision that caused harm. Agentic AI systems where no specific human decision preceded the harmful action create attribution gaps that existing tort, contract and criminal law are poorly equipped to resolve.
• International frameworks: The EU AI Act (2024) — the world's first binding AI regulation — classifies AI systems by risk category and mandates conformity assessments for high-risk applications. AI agents with internet access and tool-use capabilities would fall under high-risk or general-purpose AI provisions under this framework.

• India's IndiaAI Mission (launched 2024, ₹10,371.92 crore outlay) is building compute infrastructure and encouraging AI adoption — but the pace of agentic deployment may outstrip the development of commensurate safety and evaluation standards.
• The incidents highlight the need for mandatory third-party evaluations of AI systems before deployment in critical sectors (financial services, healthcare, public administration) — a principle that should inform India's AI governance architecture.
• Prompt injection and multi-agent attack surfaces are particularly relevant for government e-services that are increasingly integrated with AI assistants and chatbots — any compromise of such a system could have large-scale consequences for citizen data and service delivery.