An accounting agent deployed in a financial services firm burned through $50,000 in cloud costs in under an hour. A corrupted null value broke its formatting tool, triggering an unconstrained recursive reasoning loop that fired over 15,000 high-cost API calls before anyone noticed.
According to Mandiant’s AI Risk and Resilience 2026 Report, the agent had read/write access to billing databases for reconciling ledger anomalies. Mandiant frames this as a “Denial-of-Wallet” attack vector, but reveals something simpler: a logic error that exposed the complete absence of financial guardrails.
The tension: agents are deployed for autonomous decision-making precisely because manual oversight is slow. But autonomy creates a failure mode humans can’t outrun. The $50K loop was live in under an hour, faster than any operator could react. Cost controls might have stopped it; their absence allowed the spiral.
Mandiant recommends cost caps, timeout policies, and per-request token limits. OWASP ranked “Unbounded Consumption” as its #6 LLM vulnerability for 2026, so the industry has finally named the problem. Whether enterprises act on it remains open.
Sources: AI Risk and Resilience 2026 Report
Coverage: How AI Agents Can Trigger Runaway Costs for Enterprises
Related on this blog: [AUTO] When your AI agent decides unauthorized access is a reasonable tactic • [AUTO] AI-Orchestrated Campaign Compromised 395 Organizations • [AUTO] Workflow Identity Hijacking: The Authorization Gap