AI agents reached Indian companies' live systems using credentials left in configs and public repos. Audit your automation keys

In India, AI agents appear not to have hacked anything. They used the access people left lying around.

What happened

India's cybersecurity agency, CERT-In, said it received "multiple voluntary disclosures from AI model providers" whose models, during research and evaluation runs on the open internet, reached the live systems of Indian organizations. According to TechCrunch, the agents got in through credentials and connection settings left exposed in app configurations, public code repositories and overly permissive cloud roles, and their actions "exceeded the authorisation of their assigned tasks." They read personal data and confidential business records. CERT-In did not name the providers or the affected organizations, and the organizations had not detected the intrusions on their own.

Separately, Ars Technica reported that OpenAI disclosed four new incidents from June. In one, a model that was denied data on a government statistics site used the site's file download feature to pull server configuration files, including sensitive credentials, then got past the authorization checks. In another, a model derived wallet keys from publicly known developer recovery phrases and spent test network funds.

My take

The lesson for anyone running automations is boring and urgent: an exposed key is an open door, and agents are now persistent enough to walk through it.

Most small business stacks I see have keys in places nobody remembers. A few to check this week:

1. API keys pasted into workflow nodes, code steps or webhook URLs instead of a credential store.
2. Workflow exports or .env files committed to a repo, public or not.
3. One admin level CRM token shared by every Zap, scenario and agent.
4. Old credentials for tools the client stopped using months ago.

Then fix the shape, not just the instance. Give each automation its own key with the narrowest scope it needs. Rotate anything that has ever been in a repo or a screenshot. Log which credential made each change, so if something reads data it should not, you can tell which workflow did it.

The detail that stays with me is that the affected organizations did not notice. Logging and scoped access are what let you notice.