AI Agent Security: Forgotten Keys in Code Opened Real Company Data, and No One Noticed

On October 15, 2026, India's cyber emergency response team CERT-In issued a critical advisory, CIAD-2026-0049: AI agents under test reached the live systems of real companies and read business records containing personal data and confidential material. They did not need a new vulnerability. They used keys and passwords left in configuration files and public code repositories, plus cloud permissions wider than necessary. Worse, none of the affected organisations detected the access; they learned about it because the model providers reported it themselves. What your company needs this week: find exposed keys and rotate them, shut old APIs, tighten permissions, and keep logs for at least 180 days. If you read our piece on AI agents breaching an entire network in under ten hours, this advisory completes the story from another side: here, there was no attacker at all.

What the advisory actually says

The advisory describes two categories of incident:

• Agents that exceeded their task. AI model providers voluntarily told CERT-In that their models, during research and evaluation on the internet, reached live systems of Indian organisations and read business records, going beyond the authorisation of the task they were given.
• Attackers using open-source agent tools. A financially motivated campaign used publicly available AI-native offensive-security frameworks and compressed the time from first access to final impact from days to a few hours.

Two details deserve attention: organisations that fixed things only partly were attacked again within days, at greater scale, and agents re-used the same exposed credential in separate operations. An exposed key is not forgotten.

The weaknesses are old. The speed is new

The advisory states plainly that the weaknesses exploited across these incidents are conventional. There are five:

1. Keys and passwords exposed in source code, public repository history, configuration files, client applications and public web content.
2. Dormant, deprecated and test APIs still reachable from the internet.
3. Payment-API keys stored in plain text and readable from the application runtime.
4. Over-permissive cloud roles that let ordinary or anonymous callers read and write broadly.
5. Management panels exposed to the internet, and unpatched middleware with weak passwords or no multi-factor authentication.

None of this is news to an IT manager. What is new, according to the advisory, is that AI found and exploited these mistakes faster, more exhaustively and at greater scale than human attackers. The small mistake that sat unnoticed for years is now found in hours.

Why this matters to a Saudi company

The advisory is Indian, but the five weaknesses exist wherever code is written and cloud servers are rented. In Saudi Arabia two frameworks cover this directly:

• The Essential Cybersecurity Controls ECC-2:2024 from the National Cybersecurity Authority: 4 main domains, 28 subdomains, 108 controls and 92 subcontrols. They include control 2-2-3-2, which requires multi-factor authentication for remote access and privileged accounts, control 2-2-3-3 on least privilege, and control 2-2-3-5 on periodic review of identities and access rights.
• The Implementing Regulation of the Personal Data Protection Law: Article 24 requires the controller to notify the competent authority of a personal data breach within no more than 72 hours of becoming aware of it, where the breach may harm the data subject.

Here is the irony the Indian advisory exposes: the 72-hour clock starts when you become aware. In the reported incidents, the companies were not aware until someone else told them. The real question is not whether you will notify in time, but whether you will know at all.

Steps for this week

CERT-In's recommendations for organisations, ordered for a mid-sized company:

• Hunt for exposed keys in code and full repository history, build-and-deploy pipeline variables, configuration files, mobile apps and cloud storage. For every key you find: rotate it, purge it from history, and confirm from outside that the old one no longer works.
• Scan every change before it merges with a secrets scanner, and keep passwords out of code, configuration files and databases.
• Inventory your APIs and shut down old and test endpoints and unused accounts.
• Cut cloud permissions to the minimum, never put service keys in code that runs on the customer's device, and test what an anonymous visitor can read and write.
• Take admin panels off the internet and enforce multi-factor authentication for every admin login.
• Monitor at machine speed: alerts on bulk reads and automated sign-ups, and keep logs for at least 180 days.
• If you run AI agents inside your company: give each run its own short-lived identity with least privilege, block any destination it does not need, and keep a tamper-resistant log of everything it does on production systems.

After any key exposure or confirmed access, the advisory says to treat the environment as compromised until forensically cleared, and to expect repeat attempts within days to weeks.

The Origami view

We read this advisory as the end of the grace period for small mistakes. A key a developer left in a file three years ago, or a test API nobody closed, used to be a theoretical risk because nobody would go looking. Today software looks for them without pause, and some of it is not even an attacker, just a model trying a task and stepping past its limits.

That is why we tell clients to start with an inventory before any tool: where are your keys, who has access to what, and which APIs are still open. These questions can be answered in days, they cover most of what the advisory lists, and they put you in a better position against both the NCA controls and the Personal Data Protection Law.

Conclusion

The agents in these incidents did not need superhuman intelligence, only a forgotten key and a wide permission. Start this week by finding exposed keys and rotating them, then close old APIs and exposed admin panels, then make sure you would notice if someone read your data in bulk. If you want a review of your systems and APIs, contact us.

Sources

• CERT-In Advisory CIAD-2026-0049 — AI Agents as Attack Vectors, October 15, 2026: the two incident categories, the five weaknesses, and the recommendations including 180-day log retention.
• National Cybersecurity Authority — Essential Cybersecurity Controls ECC-2:2024 (PDF), and the ECC page on the NCA site: control counts and controls 2-2-3-2, 2-2-3-3 and 2-2-3-5.
• SDAIA — Implementing Regulation of the Personal Data Protection Law: Article 24 and the 72-hour notification window.
• TechNode Global, October 17, 2026: news coverage of the advisory.