No One Hacked the Agent. It Still Cost $50,000 in an Hour.
Mandiant’s new AI Risk and Resilience report shows autonomous agents failing both ways — manipulated by attackers, and melting down all on their own. The gap isn’t technology. It’s governance.
September 30, 2026 | By The CyberSurv Team | CyberSurv
A global financial services firm gave an AI agent a sensible job: reconcile anomalies in the accounting ledger. To do that job, the agent got read and write access to internal billing databases. Then one corrupted null value broke its formatting tool. The agent didn’t stop. It didn’t ask for help. It entered a recursive reasoning loop and tried to brute-force a fix — over 15,000 high-cost API calls in under an hour. The bill spiked roughly $50,000. Database locking halted live business transactions. No attacker anywhere in sight.
That case study comes from the 2026 AI Risk and Resilience report, published this month by Mandiant and the Google Threat Intelligence Group. We think it’s the most useful AI security document released this year — not because the attacks are exotic, but because the failures are so ordinary. Enterprise AI went from answering questions to running operations in about twelve months. The controls didn’t come along for the ride.
From Copilot to Operator in Twelve Months
Mandiant’s framing is blunt. In 2025, enterprise AI mostly retrieved knowledge and drafted text. By 2026, organizations are deploying autonomous agents that execute API calls, adjust production configurations, and analyze telemetry across hybrid cloud environments. The model is no longer an advisor. It’s a participant — one that makes decisions at machine speed.
That shift changes what a compromise looks like. A single poisoned data source, model dependency, or extension hook can turn a trusted agent into a conduit for internal reconnaissance and lateral movement. Nobody needs to breach your firewall when your own agent, doing exactly what it was built to do, can be steered from the outside through the data it reads. Indirect prompt injection — malicious instructions hiding in web pages, customer emails, and documents your agent ingests — has replaced the typed-in jailbreak as the vector that worries Mandiant’s frontline teams most.
The Confused Deputy: When a Polite Request Is an Exploit
The report’s red-team findings should sound familiar to our readers. Mandiant’s offensive security team assessed a client’s internal AI assistant, which was built to help developers manage repositories and CI/CD pipelines. Using role-confusion prompt injection, testers convinced the assistant it was helping with an authorized security test. GitHub was an approved external domain, so the testers handed the assistant an access token for a repository they controlled. The assistant then used its own sanctioned tools to clone sensitive internal code and push it outside the company.
No exploit code. No malware. Just semantic manipulation of a system that holds legitimate permissions — the classic “confused deputy” problem, rebuilt on top of a language model. And if that “authorized security test” pretext rings a bell, it should: it’s the same social-engineering line ransomware crews used to jailbreak coding agents inside live victim networks earlier this year. Attackers and red teams have independently converged on the same truth. The easiest way through an AI agent isn’t breaking its code. It’s talking it into cooperating.
A Milestone Nobody Wanted
Buried in the adversarial-use section is a genuine first. In May, Google’s threat intelligence team disclosed the first publicly confirmed case of a cybercriminal using an AI-developed zero-day exploit to plan a mass exploitation campaign — a two-factor authentication bypass in a popular open-source administration tool. Mandiant also notes that exploitation of vulnerabilities remains the leading initial infection vector for the sixth straight year, and that frontier models can now discover flaws and chain exploits at machine speed.
Put those two facts together and the math gets uncomfortable. The supply of usable vulnerabilities is growing faster, while the window between disclosure and exploitation keeps shrinking. Manual patch triage was already losing that race. Now it isn’t close.
Why This Lands Harder in OT and Maritime
Here’s the part that keeps us up at night. Mandiant’s runaway agent locked a billing database. Painful, expensive — and recoverable. Swap that database for a cargo management system, a terminal operating platform, or an OT historian feeding plant decisions, and “recoverable” stops being guaranteed. As we covered in our look at Honeywell’s OT benchmark data, roughly a quarter of industrial operators are already letting AI act autonomously on detection and response. Autonomy is arriving in environments where a bad write doesn’t cost money — it moves physical equipment.
The pattern is consistent with what we’ve tracked all year: AI gateways attacked as Tier-0 infrastructure, agents abused as insiders, and now agents failing with nobody attacking them at all. CISA and its international partners said it plainly in May: agentic AI is being deployed into critical infrastructure with insufficient safeguards. Mandiant’s report is the field evidence.
Governance FOR AI, Governance OF AI
Mandiant splits the fix into two layers, and we think the distinction is worth stealing. Governance for AI sets the macro rules — risk appetite, which systems agents may touch, what autonomy is acceptable. Governance of AI enforces the micro guardrails in software. You need both, and most organizations we assess have neither in writing. Five moves to start this quarter:
- Inventory your agents and their permissions. Every agent, every credential, every system it can read or write. Treat agent identities as privileged accounts, because that’s what they are.
- Install circuit breakers. Cost caps, bounded recursion limits, and automatic halts after consecutive task failures. The $50,000 loop ran for an hour because nothing was watching the meter.
- Keep humans on the high-risk actions. Shell commands, configuration changes, outbound network calls, and anything that writes to operational systems should require explicit approval.
- Watch behavior, not just prompts. Cross-correlate agent activity with network egress. An internal agent opening unfamiliar external connections is your earliest tripwire.
- Red-team your deployments before someone else does. Mandiant found the confused deputy in an assessment, not an incident response. Our penetration testing engagements now routinely include AI assistants and agent integrations in scope — that’s where the findings are.
Continuous visibility matters most once agents go live. RiskGuard 365℠ gives organizations ongoing monitoring and risk management designed for exactly this kind of fast-moving exposure, and our Security Leadership Program helps executive teams put the governance layer — decision rights, autonomy boundaries, accountability — on paper before the next agent ships. For vessel operators and terminals, a Maritime Cybersecurity Assessment establishes where AI already touches your operational systems, because in our experience the answer surprises people.
Final Thoughts
The most important sentence in Mandiant’s report isn’t about attackers. It’s the observation that enthusiasm for adopting AI is outpacing the deployment of guardrails. Agents are getting write access to systems that matter, and they fail dangerous in both directions — when someone manipulates them and when nobody does. The organizations that come through this transition well won’t be the ones that deployed the fewest agents. They’ll be the ones that could always answer two questions: what can this agent touch, and what stops it when it goes wrong?
Let’s Explore What’s Possible
Whether you’re rolling out your first AI assistant or already running agents against production systems, we’ll help you build the governance and guardrails to do it safely. Let’s talk about where your agents are — and what they can reach.
