A runaway script cost one enterprise roughly $50,000 in under an hour, with no intruder involved. Mandiant’s AI Risk and Resilience report leads with that accounting agent: it fell into an execution loop, fired more than 15,000 high-cost API calls and disrupted live transactions.
A poisoned data source, a hijacked extension hook or a compromised model dependency can each turn a dependable agent against its owner, opening routes for probing internal systems, moving sideways or escaping a sandbox.
Testers took an internal assistant wired into code repositories and CI/CD pipelines, told it a security test had been authorized, and handed it a personal access token for a GitHub repository they controlled. The host sat on the allowed-domain list, so the assistant moved sensitive internal code to the testers’ account.
Adversaries also put AI to work. Mandiant ties one campaign to a crew it calls UNC6780, better known as TeamPCP, which walked off with proprietary AI data and AI service credentials and turned prompt injection on LLM security scanners and coding assistants. VirusTotal has also caught OpenClaw skills posing as everyday automation tools, hiding stealers, backdoors and remote access software.
Mandiant’s remedy is governance plus technical guardrails, covering how AI gets used, which systems it may reach and which risks a company accepts. Its red team still finds prompt injection the leading way in, ahead of sloppy file permissions and weak access controls.
Secure development practice must reach AI engineering too, along with inventories of models and services, software bills of materials, and telemetry on agent token use, cross-application API calls, sensitive asset access and network egress.
Cost matters too: small models can absorb alert parsing and indicator checks, the expensive ones belong on investigations and threat hunting, and AI workload spend tracked like any other infrastructure line.
