From advisory chatbots to autonomous cost centers
Mandiant's AI Risk and Resilience special report, published this month, marks a shift the firm has been tracking for a while: 2025 was mostly about assistive AI, tools that retrieved knowledge and suggested answers with a human deciding what to do next. By 2026, Mandiant says, organizations have moved to distributed autonomous systems that execute API calls, adjust production configurations, and analyze telemetry on their own. That shift changes what an AI incident looks like. It is no longer just a bad answer or a leaked prompt; it is a system taking real, costly action in production without a human in the loop to catch the mistake before it compounds.
The report's most concrete illustration is a denial-of-wallet incident at a financial services firm. An agent entered a recursive reasoning loop and generated approximately 15,000 high-frequency API calls in under an hour, triggering a cloud billing spike of roughly $50,000 and causing database locking severe enough to halt active business transactions. Nothing about this involved an attacker. It was a malfunction, and Mandiant is explicit that weak operational controls, not malice, created the financial damage, which is arguably the more uncomfortable finding for any organization that has not yet put spending guardrails on its agents.
When attackers get there first
The report also documents cases where attackers deliberately targeted agentic infrastructure. In one, threat actors compromised a SaaS provider and hijacked AI coding assistant sessions, then deployed a self-propagating worm across roughly 100 internal code repositories, automating theft of secrets and source code at a speed no human operator could match. In another, attackers breached a global healthcare organization through a compromised CI/CD credential and used an LLM for real-time co-debugging of their own offensive tooling, achieving a three-hour exfiltration cycle with AI-generated IP-rotation scripts and compromising thousands of credentials in the process.
Mandiant also flags a shift in attack vectors from direct prompt injection to more sophisticated indirect injection and AI supply chain compromise, where poisoned data sources or compromised model dependencies blur traditional security boundaries. The firm's tracking of group UNC6780, also known as TeamPCP, documents at least six distinct exploitation methods used against AI tools and the open-source ecosystem, including prompt injection aimed specifically at manipulating AI coding assistants and LLM-based security scanners, a sign that adversaries are now building dedicated tradecraft against the AI layer itself rather than treating it as incidental.
The five-pillar fix Mandiant is pushing
Mandiant's defensive framework centers on what it calls hardened agent identities, and it is worth taking seriously because it is built from real incident response data rather than theory. The five pillars are hyper-segmented identity perimeters that replace long-lived API keys with workload identity federation and cryptographic identities, dual-execution authority that separates headless automated tasks from user-delegated actions, data and operational governance through financial circuit breakers and bounded recursion limits, active defense through semantic firewalls and continuous behavioral telemetry, and treating privileged developer sessions, including AI coding assistants, with the same rigor as any other privileged access.
The recurring theme across every incident in the report is that none of them required a sophisticated novel attack. The financial services agent was not hacked; it just had no circuit breaker. The coding assistant worm spread because sessions had standing access to 100 repositories without segmentation. Mandiant's summary line captures it well: AI systems are complex, highly integrated software architectures that need the same rigorous identity boundaries, runtime observability, and containment mechanisms as any other production system, and most organizations have not yet built those for their agents.
The talent problem underneath the tooling problem
Mandiant's report also points, implicitly, at a staffing gap most organizations have not budgeted for. Building the five-pillar identity model it recommends, workload identity federation, dual-execution authority, financial circuit breakers, semantic firewalls, and behavioral telemetry, requires security engineers who understand both classical identity and access management and the specifics of how agentic AI systems call tools and consume compute. That combination is scarce, and most security teams built their identity expertise around human users and service accounts, not autonomous agents making thousands of decisions per hour with real spending authority attached.
Mandiant's proposed agentic SOC model, moving through a 30 to 90 day telemetry baseline, then automated triage with read-only agent access, then analyst feedback loops to prevent baseline drift, is a sound framework, but it assumes an organization already has the monitoring maturity to establish that baseline in the first place. Organizations earlier in their security operations maturity curve will need to build foundational telemetry capability before they can even start the agentic SOC journey Mandiant describes, which is a multi-quarter investment, not a tooling purchase that closes the gap by itself.
What this means for the AI governance budget
For CTOs and CISOs, the practical takeaway is that agent governance controls are no longer a nice-to-have layered on after a pilot succeeds; they need to ship with the pilot itself. Before any agent gets production access, ask what its spending ceiling is, what its recursion limit is, and what credential it runs under, because Mandiant's data shows all three of those gaps have already caused real financial and security incidents at real companies. Budget for this now rather than after an incident, since the fixes, rate limits, circuit breakers, and scoped credentials, are cheap relative to a five-figure cloud bill or a source-code worm.
On the build-versus-buy question, this report is a point in favor of platforms and frameworks that ship these controls natively rather than expecting every engineering team to bolt them on individually. It also argues for a specific new line item in security budgets: agent behavioral monitoring, distinct from traditional SIEM and endpoint tooling, because the incidents Mandiant describes were detectable through spending and API-call anomalies that generic security tooling was not watching for. The organizations that get burned next will likely be the ones that treated agent deployment as a software rollout rather than a new class of privileged identity requiring its own governance.
