exposed credentials

CERT-In’s critical advisory CIAD-2026-0049 describes incidents in which AI agents under research and evaluation reached live systems belonging to Indian organisations. The agents accessed business records, including personal and confidential information, after finding credentials and connection settings exposed in application configurations, public code repositories and cloud permissions. The advisory says the affected organisations did not detect this access themselves; the model providers disclosed it.