E-Paper
Sign In
IIT Kanpur hires Indian teen who exposed CBSE on-screen marking flaws
Nisarga Adhikary will work as Open Source Intelligence and Threat Intelligence Engineer. 'We will provide him with the opportunity to further develop his capabilities,' said IIT Kanpur director
- PUBLISHED: Thu 11 Jun 2026, 1:21 PM UPDATED: Thu 11 Jun 2026, 1:42 PM
An Indian teenager, who shot to prominence recently after exposing flaws in the digital evaluation infrastructure of the Central Board of Secondary Education (CBSE), has landed a job at one of India’s oldest and leading engineering institutions, IIT Kanpur.
Nisarga Adhikary, 19, has joined IIT’s C3iHub as an Open Source Intelligence and Threat Intelligence Engineer, said the institute.
Recommended For You
“He is a talented young engineer who has demonstrated noteworthy technical capabilities at a young age,” Prof Manindra Agrawal, director, IIT Kanpur, told reporters on Thursday.
“We believe he has significant potential, and working at IIT Kanpur will provide him with the opportunity to further develop his capabilities while contributing to cybersecurity and threat intelligence initiatives at C3iHub. We wish him the very best in his journey ahead," Agrawal added.
Stay up to date with the latest news. Follow KT on WhatsApp Channels.
Adhikary’s disclosures on CBSE’s on-screen marking (OSM) system raised a furore in India. He claimed to have identified several vulnerabilities in the OSM-based evaluation process and reported them to the Indian Computer Emergency Response Team in the Ministry of Electronics and IT in February 2026.
'Master vulnerability'
According to Adhikary, scanned answer sheets and question papers of the CBSE were accessible because of a cloud storage configuration issue, enabling one to access them without authentication.
The teenager from Siliguri in West Bengal said the CBSE exposure was one of the easiest hacks for him. “You don’t even need to know programming, you just need to know control point F and need to know the logic. That was the master vulnerability.”
One of the hardest things was not exploitation, he had mentioned then. “The hardest part was reading a JavaScript file and editing a couple of values in DevTools.”
OTP verification had become irrelevant as the browser graded its own test, Adhikary pointed out. It took him less than an hour to find the vulnerabilities in the system and the fact that access control was broken.
Started coding young
Referring to the IIT Kanpur job, Adhikary told the media: “I am excited about this opportunity because it is the first time I will be working in a security-focused role. In my earlier jobs, I primarily worked as a software engineer, while cybersecurity was more of a hobby.”
Adhikary started coding at a young age when he was six and participated in cybersecurity contests when he was in class VI. But he is not keen on joining academia and wants to work on building startups.
