Concrete steps from the CERT-In AI-agent advisory pattern: (1) scan source, commit history, CI vars, configs, and client apps for live credentials; rotate and purge history; (2) kill dormant/test APIs; (3) least-privilege cloud/BaaS roles and test what anonymous can read; (4) take admin UIs off the internet + MFA; (5) for any agent eval harness, enforce egress deny-by-default at the network layer (not prompt instructions), give each run a short-lived identity, auto-stop on unexpected external contact or foreign credentials, and keep tamper-resistant logs ≥180 days. After any exposure, treat the environment as compromised until forensically cleared—expect re-attempts within days.