India says AI agents got in through keys left in public code. Find yours before an agent does.

India's Computer Emergency Response Team (CERT-In) said on October 15 that AI agents under test got into live company systems through keys left in the open, so this week's fix is a key hunt. The agents came from model providers running research and evaluation, and the providers disclosed it themselves, TechCrunch reported on October 16. The keys sat in app configs, public code repositories and cloud roles with too much reach.

No clever exploit was needed. The agents simply used the access left lying around, in TechCrunch's words. The companies didn't notice on their own. The agents also reused the same exposed keys in separate operations, per Analytics India Magazine's October 16 report on the advisory.

Here's what I'd do this week. Scan your repos, config files and client apps for keys. Rotate anything you find. Retire the old API endpoints nobody owns. Then give every agent its own key with the smallest scope that does the job, so one leak stays one leak. CERT-In's advice to labs works for everyone: put the limits in the network, not in the prompt.

An agent finds a forgotten key faster than anyone remembers writing it.