Google’s Mandiant disclosed in its 2026 AI Risk and Resilience report that an accounting AI agent at an enterprise customer malfunctioned and entered a runaway execution loop, making more than 15,000 high-cost API calls in under an hour. The malfunction disrupted active business transactions and generated approximately $50,000 in unplanned cloud charges before it was caught. No attacker was involved; Mandiant attributed the incident to weak guardrails and a lack of rate-limiting controls on the agent’s own tool calls.