ManifoldAgent incident ledger
← Back to tableAll incidents timeline

Suggest a change

About Accounting agent loops on a null value and runs up about $50,000 in cloud charges

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

Unnamed financial services firm· Accounting ledger reconciliation agent (model not named)

Accounting agent loops on a null value and runs up about $50,000 in cloud charges

An agent built to reconcile accounting ledger anomalies hit a corrupted null value, looped on its own reasoning, and made over 15,000 costly API calls in under an hour.

Case study 6 in Mandiant's September 2026 AI risk and resilience report. The victim is described only as a global enterprise financial services provider. The agent had direct read and write access to internal billing databases. A null value broke its formatting tool, and it then tried to brute force a fix in a recursive reasoning loop. Mandiant reports about $50,000 in cloud charges and database locking that halted active business transactions. No attacker was involved. The report gives no date, no model, and no account of who noticed or how the loop was stopped.

Updated 19 Oct 2026

First incident action to disclosure
Unknown
First incident action to discovery
Not disclosed
Noticed first by
Not disclosed
Caught
Not disclosed

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. Not disclosed

    First incident action

    A null value breaks the agent's formatting tool and it starts a recursive reasoning loop

    The agent had been set to reconcile accounting ledger anomalies, with read and write access to internal billing databases. It tried to brute force a fix.

    Reported

  2. Not disclosed

    Over 15,000 costly API calls in under an hour, about $50,000 in cloud charges

    Severe database locking halted active business transactions. Mandiant gives no timing beyond 'in under an hour'.

    Reported

  3. 16 Sep 2026

    Disclosed

    Mandiant publishes the case in its AI risk and resilience report

    The victim is not named. Help Net Security reports it the same day.

    Reported

Agent failures

Resource abuse, Destructive actionShow
Map to frameworks

  • Resource abuse

    Over 15,000 high-cost reasoning API calls in under an hour, about $50,000 in charges. Nobody asked for the work; it was a retry loop, not an attacker.

  • Destructive action

    Severe database locking halted active business transactions.

How it was found

Found first by not disclosed, from not disclosedShow
Found first by
Not disclosed
How
Not disclosed
Found to disclosed
Not disclosed

Not disclosed. Mandiant describes a sudden billing spike and locked databases but does not say who saw them, what alert fired, or how the agent was halted. Its advice is to add cost caps, circuit breakers and recursion limits, which suggests none was in place.

What is publicly known

1 of 12 fully publicShow
1 of 12 fully public
ItemPublic?DetailSources
UnknownThe report does not name the model or vendor behind the reasoning API calls.
WeakDescribed as a recursive reasoning loop making high-cost reasoning calls; no setting is stated.
PartialBy implication there was no cost cap, circuit breaker or recursion limit; Mandiant recommends them but does not list what was configured.
UnknownNot stated in the public case study.
PartialReconcile accounting ledger anomalies; no prompt text.
PartialDirect read and write access to internal billing databases and a formatting tool; no framework named.
UnknownNot stated in the public case study.
UnknownNo transcripts or call logs published.
UnknownNot stated who saw the spike or what alerted.
PartialAbout $50,000 in cloud charges and database locking that halted active business transactions. Victim anonymised; no customer or data impact stated.
KnownMandiant's account: a corrupted null value broke the formatting tool and the agent had no limits on recursion, spend or retries.
WeakMandiant lists recommended controls. It does not say what the victim changed.

Controls that apply

  • Protect

    Cap rate, spend and resources

    The agent made more than 15,000 costly reasoning API calls in under an hour, about $50,000 in cloud charges, on a ledger reconciliation task. A spend ceiling and a retry limit per run would have stopped the loop far earlier; Mandiant recommends cost caps, circuit breakers and recursion limits.

  • Give agents their own scoped, short-lived credentials

    The agent had direct read and write access to internal billing databases, and the incident locked them and halted active transactions. Narrower access for the reconciliation agent would have limited what its loop could touch; Mandiant recommends access and role controls for agents.

  • Detect

    Monitor every run and alert on what does not fit the task

    Mandiant describes a sudden billing spike and database locking that halted business transactions, but not who noticed them or when. A monitor reading the agent's calls as they came in would have raised a loop repeating on one failed formatting step at a rate no reconciliation task needs.

  • Record every agent action, outside the agent

    A record of each call, with the agent's identity and time, would show the 15,000-plus calls repeating on the null value and when the databases began to lock. Mandiant gives no date and does not say how the loop was found.

  • Respond

    A stop button outside the agent

    Mandiant does not say how the loop was stopped. A halt outside the agent, such as the circuit breaker Mandiant recommends after a set number of consecutive task failures, would have ended it sooner.

  • All controls →

Coverage and commentary

1 statement, 2 articlesShow

What the parties involved said

  • Mandiant

    Names it a Denial-of-Wallet case caused by missing governance of agents, and recommends cost caps, circuit breakers, bounded recursion and rate limits.

All 3 sources

  1. Primary source

    AI risk and resilience in 2026: A Mandiant special report ↗Google Cloud (Mandiant) · 2026-09-16

  2. Press

    One runaway AI agent racked up a $50,000 cloud bill ↗Help Net Security · 2026-09-16

  3. Commentary

    Mandiant says one runaway AI agent racked up $50,000 in an hour ↗shashi.co · 2026-10-09

Entry id unnamed-financial-services-denial-of-wallet-2026 · overall Reported · impact moderate