A $50,000 agent loop, a six-hour credential heist, and Google's answer to both

The report

Mandiant and GTIG published "AI Risk and Resilience 2026," structured around four pillars: adversarial use of AI, offensive testing, securing AI systems, and modern defense architecture. Two of its case studies are worth sitting with, because they are not the same kind of problem, and treating them as one problem is exactly how agent security programs end up with the wrong controls.

Case Study 2 covers a six-hour credential-theft campaign against a global healthcare organization, attributed to the threat actor UNC6780 (also tracked as TeamPCP). Per Mandiant's own report, the actor "implemented more than half a dozen different methods to exploit AI tools and the open source software ecosystem, including manipulating the behavior of AI coding assistants and LLM security scanners through prompt injection," compromising thousands of credentials via a three-hour exfiltration cycle. This is an adversary. It planned, it executed, it exfiltrated. GTIG's earlier account of the same campaign first reached outlets on September 8.

Case Study 6 is a different animal entirely. A financial services provider gave an accounting-reconciliation agent direct read/write access to internal billing databases. The agent hit a corrupted null value in its formatting tool and, per the report, "entered an unconstrained, recursive reasoning loop to brute force a fix." In under an hour: over 15,000 high-frequency API calls, a roughly $50,000 cloud-billing spike, and database locking severe enough to halt active business transactions. No attacker. No exploit. Just an agent with too much write access and no ceiling on cost or retry count, doing exactly what it was told in a way nobody anticipated.

Mandiant's own framing: "Defending against these autonomous threats requires transitioning to clearly identified, adaptive identity controls, accelerating defensive velocity, and reorienting the SOC toward real-time behavioral telemetry."

The report also cites VirusTotal's February 2026 finding that attackers were distributing backdoors, droppers, and infostealers disguised as legitimate OpenClaw automation skills, a third failure mode again: supply chain, not adversary-in-the-loop, not runaway execution.

Three case studies, three different root causes, one report. That's the actual state of agentic AI risk right now: it isn't one problem with one fix.

Google's answer, shipped the same week

On September 17, Google put Agent Anomaly Detection into private preview on the Gemini Enterprise Agent Platform. Per Google's own Developers Blog, it watches for tool misuse, identity and privilege abuse, agentic cascading failures, rogue behavior, and resource exhaustion, using a layered approach: a statistical pass flags unusual sessions, LLM-based reasoning digs deeper, and an optional third layer inspects individual tool invocations. Findings route to Security Command Center with severity levels and recommended actions.

Read that list of targeted behaviors again next to Case Study 6. "Agentic cascading failures" and "resource exhaustion" are Mandiant's runaway-loop incident, named almost verbatim. Google didn't draw that line explicitly in its own materials, and neither will we beyond noting it: one arm of the same company just documented the problem, and another arm shipped a product against it, in the same week. That's not a coincidence worth over-reading, but it's not nothing either.

What it doesn't cover, at least based on what's public so far, is the UNC6780 pattern: an adversary manipulating an agent's behavior through prompt injection to get it to do reconnaissance and exfiltration on the attacker's behalf. Detecting "this session looks statistically weird" is a different problem than detecting "this agent is being steered by an attacker who is otherwise indistinguishable from a legitimate task."

The part that doesn't get a vendor product

Nobody in either story is named. Not the healthcare organization, not the financial services provider. That's normal for incident reporting and not a criticism of Mandiant's disclosure practices. But it does mean the two headline numbers in this cycle, thousands of credentials and fifty thousand dollars, are both currently unfalsifiable by anyone outside Mandiant and the affected organizations. We're treating them as reported, not as independently verified, and saying so plainly.

The more durable takeaway isn't the dollar figure. It's that an agent with database write access, no cost ceiling, and no retry limit will eventually find the one edge case that turns "helpful automation" into "denial of wallet," with zero attacker required. That's a design question, not a detection question, and no anomaly detector, however good, replaces the work of not giving an agent more blast radius than the task needs in the first place.

Try it yourself

If you're running agents with any meaningful tool access and haven't adversarially tested what they can actually do when something goes wrong (not "if," when), that's exactly the gap between "we have guardrails" and "we've checked the guardrails hold."

pip install humanbound

Source, issues, and the full engine:

humanbound / humanbound

Open-source adversarial testing engine, SDK, and CLI for AI agents. Runs locally or against the Humanbound Platform.

humanbound

Open-source adversarial testing engine, SDK, and CLI for AI agents
Attack your agent the way real users and attackers will: live endpoints multi-turn conversations, tool abuse. Then turn every failure into a firewall rule.
Runs locally or against the Humanbound Platform. No login required to start.

Quick Start · Test-to-Guardrail Loop · SDK · Documentation · Contributing

📖 Full documentation lives at docs.humanbound.ai — this README covers the essentials; the docs have the depth.

Why Humanbound

Most testing tools test prompts. Humanbound tests agents: it drives multi-turn conversations against your real endpoint, probes tool use and scope boundaries, and scores the results against your security policy. When tests fail, hb guardrails converts the findings into deployable firewall rules — so the same run that finds a hole also patches it.

Quick Start

Install

pip install humanbound                       # CLI + SDK, core deps
pip install humanbound[engine]               # + OpenAI

…

View on GitHub

DEV Community