AI Agents Pose New Risks: From Cloud Bills to Supply Chain Compromises
Mandiant and Google Threat Intelligence Group report on escalating security risks from autonomous AI systems, including indirect prompt injection, AI supply chain attacks, and runaway agents causing significant cloud expenses.
Organizations are increasingly deploying autonomous AI systems capable of executing API calls, optimizing production configurations, and analyzing telemetry across hybrid cloud environments. However, this advancement brings a new wave of security challenges. Attacks are evolving beyond simple direct prompts to more sophisticated methods like indirect prompt injection and AI supply chain compromises, blurring traditional security boundaries.
Mandiant's latest AI Risk and Resilience report, compiled with insights from Google Threat Intelligence Group (GTIG), highlights how compromised data sources, vulnerable model dependencies, or malicious extension hooks can transform trusted AI agents into conduits for internal reconnaissance, lateral movement, or even autonomous escape from security sandboxes. "Defending against these autonomous threats requires transitioning to clearly identified, adaptive identity controls, accelerating defensive velocity, and reorienting the SOC toward real-time behavioral telemetry," stated Mandiant.
Threat actors are actively leveraging AI to their advantage. Adversaries are offloading operational tasks to AI and integrating Large Language Models (LLMs) into multi-stage attacks, where the models participate in decision-making and facilitate pivots between attack phases. Some are developing middleware, proxy relays, and automated registration systems to circumvent safety guardrails and billing constraints inherent in commercial AI platforms.
GTIG has observed threat actors employing AI for vulnerability research, utilizing persona-driven jailbreaking techniques and specialized security datasets to accelerate vulnerability discovery and exploitation. Furthermore, attackers are adapting software supply chain tactics to the AI ecosystem. For instance, malicious OpenClaw skills disguised as legitimate automation packages were found to contain backdoors, droppers, infostealers, and remote access tools. More recently, Mandiant investigated incidents involving supply chain compromises by UNC6780 (TeamPCP), who stole AI service credentials and proprietary AI data, and employed prompt injection against AI coding assistants and LLM-based security scanners.
Red teaming exercises conducted by Mandiant reveal that prompt injection remains a primary attack vector for enterprise AI deployments, alongside issues such as improper file permissions and inadequate access controls. In one assessment, testers successfully manipulated an internal AI assistant managing code repositories and CI/CD pipelines by convincing it that it was part of an authorized security test. The AI was then tricked into cloning sensitive internal repositories and pushing them to an external GitHub account controlled by the testers, demonstrating how legitimate permissions can be abused.
Beyond direct attacks, uncontrolled AI agents can lead to significant financial and operational disruptions. In one case study, an accounting agent entered a runaway execution loop, making over 15,000 high-cost API calls in under an hour. This resulted in approximately $50,000 in cloud charges and disrupted active business transactions, illustrating the potential for unintended consequences even without malicious intent.
Mandiant recommends that organizations implement robust governance and technical controls for AI usage, defining what systems AI can access and which risks are acceptable. Protection must extend across the AI software supply chain, with strategies varying based on whether an organization consumes third-party AI services, integrates models into applications, or trains and hosts its own models. For open-weight models, which may have limited documentation regarding datasets and training code, organizations face additional responsibilities.
To secure the AI development pipeline, organizations should extend secure software development practices to AI engineering, maintaining inventories of models, applications, and services. Automated software bills of materials (SBOMs) are crucial for tracking components and dependencies. Defenders must collect comprehensive telemetry, including agent token usage, cross-application API calls, and access to sensitive assets. While AI agents can accelerate security operations, organizations must also track AI workload costs and match appropriate models to specific tasks to optimize spending and ensure security.