Mandiant 2026 AI report: a runaway agent's $50,000 bill and AI-assisted intrusions

Mandiant's AI Risk and Resilience 2026 report, published on Google Cloud in September 2026 and covered the same week by Help Net Security, The Hacker News and SecurityBrief, describes three engagements in which AI was the mechanism rather than the target: a hijacked AI coding-assistant session that spread the Shai-Hulud worm across about 100 internal repositories at an unnamed software-as-a-service provider; a compromised CI/CD credential that an intruder turned into an AI-assisted offensive hub inside a healthcare company, exfiltrating thousands of credentials; and an accounting agent that ran up roughly $50,000 in cloud charges in under an hour after a corrupted null value broke one of its tools, locking a billing database and halting live transactions. No attacker was involved in the third case. The record this article is built on, and the entries filed around it, are in the AI incident archive, which carries each entry's own sources, severity, confidence grade and disputed flag.

What kind of document this is

The report is titled "AI risk and resilience in 2026: A Mandiant special report" on Google Cloud's security resources page, and it is a vendor publication rather than a breach disclosure. Its case studies come from Mandiant's incident-response engagements and from assessments by its Offensive Security team, and the organisations are identified only by sector: a software-as-a-service provider, a global healthcare organisation, a global enterprise financial services provider. No victim is named, no intrusion is dated, and no victim statement accompanies any of the three.

That shapes how the figures should be read. Every number in them originates with Mandiant's own investigators. The Cloud Security Alliance's Frontier Ready note of 16 September labels the approximately $50,000 charge and the 15,000-call volume "self-reported (provider metric)" and says they "have not been independently verified" — a fair description of the whole report, which publishes no third-party telemetry to check against. The archive files this entry as an informational record, a report rather than an incident with recorded harm, and grades it confidence A without flagging it as disputed; that grade speaks to how well the report is documented, not to whether an outside party has confirmed its contents.

The report's own framing is that adversaries moved in 2026 from asking chatbots for research to letting agentic systems carry parts of an intrusion. Mandiant says Google Threat Intelligence Group has observed actors deploying autonomous tooling including Hexstrike and Strix for reconnaissance and credential harvesting, and building proxy relays and automated registration pipelines to get around guardrails and billing limits on commercial AI platforms. It cites the February weaponisation of OpenClaw agent skills that VirusTotal documented, supply-chain compromises in March that Mandiant attributes to the actor it tracks as UNC6780 and others track as TeamPCP, and a May disclosure that GTIG described as the first publicly confirmed case of a cybercriminal using an AI-developed zero-day exploit, one that bypassed two-factor authentication in a popular open-source administration tool.

Case one: the assistant recommended the package

In the first case, an attacker compromised a software-as-a-service provider and then took over an active AI coding-assistant session on a developer's workstation. Mandiant describes the assistant as "operating as a trusted interpreter within the environment": it recommended the installation of an external software package that the attacker had already poisoned, and the developer accepted the recommendation. The report says the assistant "inadvertently functioned as a trojan horse".

From the live session the attacker installed an infostealer through a poisoned PyPI package and harvested the developer's GitHub OAuth tokens. The self-propagating Shai-Hulud worm then moved across approximately 100 internal code repositories, automating the theft of repository secrets and the programmatic exfiltration of proprietary product source code. The attacker also poisoned a package inside the organisation's official namespace, and a second employee pulled the compromised version — a downstream infection that, on Mandiant's account, needed no further action from the intruder.

What the report does not say is when any of this happened, or how the attacker got control of the assistant session in the first place. The Hacker News, reporting the case study on 16 September, notes both omissions. The Cloud Security Alliance's 18 September research note on the case calls the initial-access vector "the case study's most significant open question" and observes that Mandiant's recommended controls address how far an infection can travel, not how the session was seized.

Mandiant's controls for this case are three, and they are specific about the failure: enforce IDE and CLI verification hooks that check every AI-recommended third-party dependency against cryptographic checksums and an approved allowlist; keep raw API keys, long-lived OAuth tokens and other secrets out of reach of extensions; and restrict workstation network egress so dependency traffic routes only through controlled internal repositories.

Case two: a CI/CD credential turned into an AI co-debugging hub

The second case is an enterprise cloud investigation at a global healthcare organisation. Mandiant traced anomalous activity to a compromised long-lived developer CI/CD credential, which the intruder used to spin up an unisolated VM instance and convert it into a live offensive hub. Rather than build tooling offline, the attacker wired large language models directly into the running server and iterated against them in place.

Mandiant describes a three-stage workflow. First came context priming: code packages synchronised through remote sessions and project README files loaded into the model's chat context, to steer later code generation toward the campaign's goals. Then interactive debugging: the attacker had the model construct a multi-worker data-harvesting framework and worked through logical script-splitting errors with it, raising the exfiltration cadence to a three-hour cycle. Finally evasion and exploitation: the model wrote dynamic IP-rotation scripts to swap blocklisted server addresses on the fly, and co-developed a Rust-based tool for logging into victim accounts and checking financial balances.

Mandiant says the campaign compromised thousands of credentials and exfiltrated harvested API keys and financial secrets to a repository the attacker controlled. The report does not say whose accounts the Rust tool was pointed at, what the financial balances it checked belonged to, or what became of the credentials afterwards. No patient data is mentioned anywhere in the case study.

The recommended controls follow the credential rather than the model: replace long-lived access keys with short-lived Workload Identity Federation trust relationships using OIDC; contain egress with VPC Service Controls so runtime and development environments cannot reach unapproved external model providers; run continuous secrets scanning across workspaces; and put a runtime prompt firewall such as Model Armor in the path to intercept hardcoded credentials and block offensive utility scripts as they execute.

Case three: the agent that spent $50,000 in under an hour

The third case had no adversary. A global enterprise financial services provider deployed an agent to reconcile anomalies in its accounting ledger and gave it read and write access to internal billing databases. A corrupted null value broke the agent's formatting tool, and the agent responded by entering what Mandiant calls an unconstrained, recursive reasoning loop to brute-force a fix.

In under an hour it issued more than 15,000 high-frequency, high-cost reasoning API calls, producing a sudden cloud-billing spike of roughly $50,000. The same loop caused severe local database locking that halted active business transactions. Mandiant files the case under "denial-of-wallet", and the fixes it prescribes are operational rather than model-level: a spending cap, bounded recursion, and a circuit breaker to stop an agent that keeps failing the same task.

The report does not say whether the charge was paid, credited or disputed, how long transactions were halted, whether customers were affected, or what the firm changed afterwards. It also gives no date. SecurityWeek's 18 September roundup groups it under what the report flags as a new financial risk category rather than a conventional intrusion.

Mandiant's proposed controls are correspondingly financial: identity and role-based access definitions for agents, cost-cap thresholds and monitoring as governance, plus automated financial circuit breakers that halt an agent after a set number of consecutive task failures. At the service and project level it recommends hard financial caps, bounded recursion limits and rate limits, so that a self-correction loop is throttled before it becomes an outage.

What is established, what is attributed, what is not disclosed

Established. Mandiant published this report, and it says what is summarised above. Four trade outlets covered it within three days of each other — Help Net Security and The Hacker News on 16 September, SecurityBrief UK on 17 September and SecurityWeek on 18 September — and their accounts match the report's on every figure they repeat. The Cloud Security Alliance published a separate research note on the first case on 18 September, reaching the same reading of its mechanics and the same conclusion about what Mandiant left out.

Attributed, not independently verified. The specific numbers are Mandiant's: approximately 100 repositories, thousands of credentials, a three-hour exfiltration cycle, 15,000-plus reasoning calls, roughly $50,000, under an hour. No outlet has published telemetry from any of the three victims, and none of the three has been named by anyone. The corroboration that exists is corroboration of the report's contents, not of the events. That distinction is the whole of what a reader can rely on here, and the archive's confidence grade should be read that way too.

Not disclosed. The report gives no dates for any of the three engagements, no victim names, and no account of how the assistant session in case one was taken over. It does not say whether the harvested GitHub OAuth tokens and repository secrets were revoked, whether the thousands of credentials from case two were used or reset, whether the healthcare organisation's data subjects were affected, whether the accounting agent's charge was recovered, or what any of the three organisations changed afterwards. This article found no victim statement, regulator's notice or follow-up reporting published since 16 September that fills those gaps.

Where coverage diverges. The Cloud Security Alliance note describes the second infection in case one as spread through the company's own npm namespace. Mandiant's text says only "a package inside the organization's official namespace" and does not name an ecosystem there; the npm reading is an addition, not a quotation. Separately, The Hacker News is explicit that the worm in this case is not linked by available evidence to the August npm worm that planted hooks for coding assistants, or to a Shai-Hulud variant found scanning 469 locations for credentials — the same family name, separate campaigns, with no evidence in the article linking them.

What the report says should change

Mandiant's recommendations repeat across the report's case studies: move off long-lived credentials and service accounts onto identities bound to a workload and short-lived by design; treat AI coding assistants and MCP servers as privileged sessions whose extensions and CLI hooks are verified before execution; enclose agent workloads in network perimeters that block egress to unapproved model providers; and instrument token use, cross-application API calls and agent access to sensitive assets so that a first-time read of a sensitive repository shows up as a signal rather than blending into legitimate tool traffic.

On cost, it draws a line between governance of AI and governance for AI: policy that sets risk appetite and procurement rules on one side, and enforced technical limits on the other. The accounting agent is the report's example of the second kind failing: on Mandiant's account nothing in its deployment bounded the loop, and the controls that would have caught it — a cap, a rate limit, a circuit breaker — are ordinary ones applied to an unusual workload.

The three cases do not share a cause. One is a trust problem, where an assistant's recommendation carried the authority of a colleague's. One is a credential problem that predates any model, with the models making the intrusion faster and more adaptive once inside. One is neither: no attacker, no exploit, just an agent given write access to a ledger and no ceiling on what it could spend to fix a broken tool. What they share is that in each, the AI system had authority that nobody had scoped — to recommend, to reconfigure, to keep trying.