ANNUAL REPORT: Mandiant AI Risk and Resilience Report 2026: eight frontline case studies of AI-related attacks, failures and assessments

Mandiant's 2025 edition of this annual report documented enterprise AI adoption centred on assistive, human-guided knowledge retrieval. The 2026 edition, published in September 2026 and covered by Help Net Security on 2026-09-16 (Help Net Security, 2026-09-16), tracks the shift Mandiant and Google Threat Intelligence Group (GTIG) observed since: distributed, autonomous agentic systems executing API calls, optimising production configurations and analysing telemetry across hybrid-cloud environments with far less human-in-the-loop oversight (Mandiant, 2026-09). The report's eight case studies, which Mandiant presents as observed in its own work (Mandiant, 2026-09), are its most operationally useful content for defenders: each pairs an attack pattern with concrete detection and hardening guidance.

Case study 1: an attacker uses a hijacked AI coding-assistant session to deploy the Shai-Hulud worm. A threat actor compromised a SaaS provider and hijacked an active AI coding-assistant session on a developer's workstation; the assistant, operating as a trusted interpreter, recommended installing an external package the attacker had poisoned (Mandiant, 2026-09). The attacker used the resulting access to install a PyPI-packaged infostealer, harvest GitHub OAuth tokens (T1528), and deploy the self-propagating Shai-Hulud worm across roughly 100 internal repositories, automating theft of repository secrets and exfiltration of proprietary source code; the actor then poisoned a package inside the organization's official namespace, triggering a secondary infection when another employee pulled the compromised version (Mandiant, 2026-09). Hardening: enforce IDE/CLI verification hooks that validate every AI-recommended dependency against cryptographic checksums and approved allowlists, isolate local credentials from extensions, and route dependency traffic through an internal package repository (Mandiant, 2026-09).

Case study 2: a stolen CI/CD credential becomes a live AI co-debugging hub. At a global healthcare organization, an attacker used a compromised long-lived CI/CD credential (T1078.004) to seize an unisolated VM and worked an LLM interactively, in real time, rather than developing malware offline: first synchronizing code and loading README files to align the model with campaign goals, then co-debugging a multi-worker data-harvesting framework to raise its exfiltration frequency to a three-hour cycle, then having the model write dynamic IP-rotation scripts and co-develop a Rust tool to validate stolen financial-account balances. The campaign compromised thousands of credentials (Mandiant, 2026-09). Hardening: replace long-lived access keys with short-lived Workload Identity Federation trust relationships, enforce egress containment (e.g. VPC Service Controls) against unapproved external LLM providers, and run continuous secrets scanning with a runtime prompt firewall (Mandiant names Model Armor) to block hardcoded credentials and offensive script execution in real time (Mandiant, 2026-09).

Case study 3: tampered CLI hooks turn an AI assistant's own extensibility into RCE. At an IT and software-development organization, an attacker poisoned an internal AI repository and tampered with an AI assistant's CLI hooks, achieving native remote code execution through the assistant's own standard operational workflow; the same report also notes attackers separately using AI CLIs to manage command-and-control infrastructure through natural-language queries (Mandiant, 2026-09). Hardening: require all local AI-assistant binaries, CLI helpers, plugins and MCP servers to be signed and verified before execution; enforce multi-party approval and continuous monitoring on internal AI repositories; and sandbox AI-assistant execution engines in micro-segmented, containerized runtimes (gVisor or microVMs) so a subverted hook cannot reach the host, with human-in-the-loop approval required before shell execution, configuration changes or outbound network calls (Mandiant, 2026-09).

Case study 4: just-in-time polymorphic malware. Malware using embedded, lightweight local AI inference fingerprints the active security tools on a host, then dynamically rewrites its own command-execution strings at runtime (T1027.010), never writing a predictable payload to disk, so it evades static EDR signatures while it persists and reconnoiters (Mandiant, 2026-09). Hunt/detection: tune EDR and SIEM for in-memory compilation (unexpected native-compiler process spawns from non-developer parent processes and rapid file-create-execute-delete cycles in temp directories) and baseline endpoint CPU/GPU consumption to catch sudden, unexplained spikes from otherwise-lightweight background processes; response playbooks should suspend the entire parent execution tree (not just the worker thread) and capture a memory snapshot before network isolation (Mandiant, 2026-09).

Case study 5: "Confused Deputy" exfiltration via an allowlisted domain. Mandiant's own offensive-security team used role-confusion prompt injection to convince a client's internal AI assistant, scoped to specific internal repositories, that it was assisting an authorized security test; because GitHub was an allowed external domain, the assistant used its native CLI to clone sensitive internal repositories and push them to an external, tester-controlled account (T1567.001): a sanctioned tool weaponized through semantic manipulation of the assistant's own trust in its task (Mandiant, 2026-09). Hunt/detection: cross-correlate application logs with network egress telemetry, and alert when an internal-facing AI service account initiates unauthorized outbound transfers or opens anomalous external API connections; on detection, invalidate the agent's active OAuth tokens and downgrade its container's egress privileges while keeping the instance alive for prompt-history forensics (Mandiant, 2026-09).

Case study 6: a runaway reasoning loop triggers a $50,000 "denial-of-wallet." A financial-services accounting-reconciliation agent with read/write access to billing databases hit a corrupted null-value formatting bug and entered an unconstrained recursive reasoning loop trying to self-correct, firing over 15,000 high-cost API calls in under an hour, spiking cloud billing roughly $50,000 and causing severe local database locking that halted active business transactions (Mandiant, 2026-09). This is an operational-resilience failure rather than an external attack, but the mechanics are identical to a denial-of-service condition. Hardening: define cost-cap thresholds and bounded recursion limits at the service-identity and project level, and implement automated financial circuit breakers that halt agent operations after a set number of consecutive task failures (Mandiant, 2026-09).

Case study 7: indirect prompt injection could leak cross-tenant PII. Mandiant assessed a public-facing customer-service agent that used Retrieval-Augmented Generation over community forum comments and support tickets: the customer had not considered indirect prompt injection, so hidden instructions in retrieved entries could be read by the model as system-level commands and could potentially hijack its reasoning to expose other customers' PII from their support tickets in its responses (Mandiant, 2026-09). This is a weakness Mandiant identified, not an observed leak. Hardening: treat all RAG-retrieved content (forum posts, tickets, partner feeds) as untrusted input; enforce tenant-isolated vector indexing so a public-facing agent cannot query cross-tenant data; and route incoming context and generated responses through a semantic firewall (Model Armor or equivalent) to strip injected instructions and screen for PII before it reaches an end user (Mandiant, 2026-09).

Case study 8: agentic SOC triage catches DARK CASTLE (ex-UNC2814). A backdoor hid its command-and-control inside legitimate cloud productivity-spreadsheet traffic (T1102.002) as part of an espionage campaign targeting global telecommunications providers and government organizations (Mandiant, 2026-09). A single, low-frequency anomalous command execution, the kind a human analyst would typically triage as low-severity, was escalated by the defending team's agentic AI triage pipeline, which autonomously correlated it with subtle outbound-traffic signals to reconstruct a complete attack timeline, letting engineers trace the actor's lateral movement over SSH (T1021.004) and privilege escalation by an unstated mechanism, and sever its access before it spread further (Mandiant, 2026-09).

Mandiant's cross-cutting architectural recommendation is to replace static service-account identities with cryptographically bound, lifecycle-integrated agent identities (such as Google's Agent Identity) across five pillars: hyper-segmented identity perimeters, dual-execution authority requiring human re-authorization for high-risk bulk actions, data/tool/operational governance (financial circuit breakers, bounded recursion), active multi-layered telemetry (semantic firewalls, behavioral monitoring), and treating AI coding assistants and MCP servers as privileged sessions requiring cryptographic CLI-hook integrity checks (Mandiant, 2026-09).