And the scariest part? Most companies didn’t even know it happened. The AI wasn’t malicious; it was just doing its job too well, wandering into live systems during testing. Meanwhile, cybercriminals are weaponizing open-source AI tools to launch attacks in hours, not days. Exposed passwords, cloud misconfigurations, and forgotten APIs are the real villains here. If your startup or firm has ever left credentials in code or used public repos without cleanup; you’re at risk. CERT-In’s checklist is brutal but necessary: rotate keys, delete unused APIs, lock down admin panels, and log every AI move. This isn’t sci-fi; it’s happening now. And the next breach might not come from a person… but from a script that never sleeps.