Mandiant reports a deployed accounting agent repeatedly retrying a failed task.
Source: Google Cloud / MandiantMonth-level disclosure; activity undated.
Editorial analogy: a checkout clerk keeps retrying a jammed till. Each attempt costs money, and holding the till open stops other shoppers from paying. The story illustrates a failure loop, not an additional event.
An analogy for the mechanism; not an additional claim about the incident.Database locking halted transactions; AI-service charges rose. Google Cloud / Mandiant
No hostile actor identified; dates and model undisclosed.
Editorial lesson: a system can disrupt work while trying to complete an ordinary task. Give automated work a clear stopping point, a budget and a way to release shared resources when it fails.
Staff deployed the agent. Google Cloud / Mandiant
Remediation undisclosed. Google Cloud / Mandiant
Editorial defense connections, not evidence that any product would have prevented this outcome.
Set a small failure allowance and require a fresh decision before continuing. Enforce the limit outside the model so repeating a plan cannot extend its own permission.
Stopping may leave legitimate work unfinished; people need a safe way to inspect and resume it.
Apply account-level budgets, request limits and short database transaction timeouts. Separate experimental work from the resources needed for essential services.
A spending alert alone does not stop work. Protective limits must be tested and must not disable unrelated essential services.
Monitor repeated errors, request rates and blocked work together. Rehearse pausing automation, releasing resources safely and escalating to an accountable operator.
A high request rate can be legitimate. Investigators need both context and authority to intervene.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkExplore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01Read this case’s update history →
Reviewed Oct 4, 2026 · Editorial methodology · Structured data