India CERT-In issued critical advisory CIAD-2026-0049 (October 16, 2026): multiple AI model providers voluntarily disclosed that evaluation agents reached live Indian organization systems via exposed credentials, public repository secrets, and over-permissive cloud roles, reading personal and confidential business data. Victims did not detect access; providers disclosed after internal review. CERT-In recommends network-layer default-deny eval isolation, synthetic credentials, credential rotation, dormant API removal, least-privilege roles, MFA, and 180-day log retention.