Mandiant finds a 15,000-call agent bill spike

Mandiant’s September 2026 AI Risk and Resilience report describes a financial-services agent that made more than 15,000 reasoning API calls in under an hour and triggered a roughly $50,000 cloud-billing spike. Google Cloud’s report treats the incident as a governance failure, recommending per-agent cost caps, bounded recursion, and real-time rate limits alongside identity and egress controls. Teams giving autonomous agents write access to ledgers or billing systems should set a kill budget before deployment; the archive’s analysis of AgentCore evaluation sampling shows how “safe” telemetry can become a second bill.