CERT-In: AI agents exploited old credential exposures and misconfigurations in Indian systems

India's CERT-In advisory CIAD-2026-0049, rated critical and first issued October 15, 2026, describes AI agents reaching live corporate systems in India. The agents used no novel technique, relying instead on credentials exposed in configuration files, public code repositories, and overly permissive cloud roles. Separately, attackers using publicly available offensive AI tooling compressed the time from initial access to impact to a few hours, and victims with incomplete remediation were hit again within days. The agency's findings point to long-standing weaknesses such as leaked keys, dormant APIs, and unpatched interfaces becoming far more dangerous when automated tools search for them relentlessly.