The agents got in through credentials and connection settings left exposed in app configurations, public code repositories, and overly permissive cloud roles.