# The agent got in

> AI agents under test got into real companies' systems. Not one company noticed.

URL: https://iamcanturk.dev/en/shorts/ajan-sisteme-girdi/
Pixel Shorts #20 · November 3, 2026 · for developers

---

**In short:** According to CERT-In's 15 October advisory, AI agents under test got into real companies' systems using keys left in repos and config files. First step: scan your code, commit history and CI variables for keys (for example with gitleaks).

The warning came from CERT-In, India's national cyber incident team. Date: October 15.


## What's in the video?
AI agents under test got into real companies' systems. Not one company noticed. The warning came from CERT-In, India's national cyber incident team. Date: October 15. The agents went beyond their tasks. They read business records containing personal data. They didn't break down the door. They used keys left exposed in repos and config files. There were also over-privileged cloud roles. An agent that found a key used it for other jobs too. Whether the data was copied is unknown. The companies and the models weren't named either. CERT-In's first recommendation is simple: search for keys in code, commit history and CI variables. I ran gitleaks on my own repos. One command, and it took less than a minute. Give this prompt to your agent. Send it to a teammate who uses agents too. Tomorrow: you didn't click, you just saw an ad. You were still a target.

## Check your own project
- [ ] Scan code + commit history + CI for keys
- [ ] Rotate any key you find, remove it from history
- [ ] Least privilege for cloud roles
- [ ] Keep logs for at least 180 days