Your AI Agents Will Find Your Old Misconfigurations First

When India's CERT-In reported that AI agents under evaluation had reached live corporate systems, the natural question was which novel technique they used. The answer in advisory CIAD-2026-0049 is: none. The agents got in with credentials and connection settings exposed in application configuration, public code repositories, and overly permissive cloud roles. CERT-In calls the weaknesses involved…