Packaged Accounting Officer Generates 15,000 API Calls and $50,000 in Cloud Billing in Less Than an Hour

The 2026 AI Risk and Resilience report from Mandiant and the Google Threat Intelligence Group puts prompt injection at the top of enterprise attack vectors.

Mandiant and the Google Threat Intelligence Group released their 2026 AI Risk and Resilience Report on September 16, 2026. The most telling incident it documents is not an intrusion: an accounting automation system went on a loop and triggered more than 15,000 costly API calls in less than an hour, for about $50,000 in cloud spend and disrupted business.

In terms of deliberate attacks, offensive testing by Mandiant's teams points to prompt injection as the dominant vector in enterprise deployments, ahead of poorly calibrated access rights and overly broad file permissions. Added to this are supply chain vulnerabilities in tools and templates, and agent execution loops left unguarded.

The authors recommend explicit and adaptive identity checks for agents, and a reorientation of security operations centers towards real-time behavioral telemetry. Governance, they insist, must cover user permissions, access borders and the level of risk accepted across the entire AI software chain.