No attacker was involved. An accounting agent, doing the job it was given, looped on paid API calls until the bill reached about $50,000. The case was documented by Mandiant in its AI Risk and Resilience report, published 2026-09-16.
What happened
As reported in the coverage of the Mandiant case, the agent made more than 15,000 paid API calls in under an hour and ran up roughly $50,000 in cloud charges. Nothing in its path said no. The calls were allowed, one after another, until a human noticed the damage.
The three controls named missing
The coverage frames the failure the same way in source after source, and it is worth quoting the shape of it rather than the bill:
- No hard ceiling in the call path. Nothing evaluated the next call against a limit before it ran, so the loop continued until a human intervened.
- No kill switch. There was no fast, deliberate way to stop the agent once the loop was visible.
- No accountable owner. No named person owned this agent, its limits, and its stop button.
What about the caps in your provider console?
They exist, they are free, and you should set them. OpenAI, Anthropic, and Google all offer customer set monthly caps. Their limits are the point: they are monthly only, they sit at organization, project, or workspace level and never per agent or per key, each covers a single provider, and they stop traffic after tracked spend crosses the line, with documented lag. A loop like this one spends inside that lag. What the consoles do not offer is a refusal before the call spends, one ceiling across providers, or a per agent stop.
Why this matters for small teams
The stack in this case was an internal enterprise system, but the failure shape is not enterprise specific. Any agent that can call a paid API in a loop has the same shape: allowed calls, no ceiling, no fast stop. The smaller the team, the more a single hour like this hurts.
Sources
- Mandiant AI Risk and Resilience report coverage, Shashi: shashi.co, 2026-10-09
- CyberSurv, 2026-09-30
- Daily AI Wire, 2026-10-05
Check your own setup against the three controls in two minutes: take the free Spend Guard self-check. It names the gaps in your answers, in plain words.