Mandiant has published its AI Risk and Resilience Report, which examines threats targeting AI tools and autonomous agents.
The research draws on observations from Mandiant and Google Threat Intelligence Group as attackers adapt established intrusion methods to AI-assisted software development and operational systems.
The findings show a shift in how security teams must assess exposure as AI systems move beyond advisory roles to execute API calls, manage workflows, and make decisions without direct human involvement at every step.
One of the central case studies covers the "Shai-Hulud" worm. Attackers hijacked an active AI coding assistant session at a software-as-a-service provider after using a poisoned software package to install an infostealer.
The intrusion let them collect GitHub OAuth tokens and spread the worm across about 100 internal code repositories, leading to the theft of repository secrets and proprietary source code.
Attack paths
A separate example focused on AI command-line interfaces and extensions. In that case, attackers poisoned an internal AI repository and tampered with the assistant's command-line hooks.
The altered execution path created a route to remote code execution through the AI platform's normal workflow. The report presents this as an example of how assistant extensibility features can become entry points for attackers.
Another case study examined the cost and operational disruption that can follow when autonomous logic is left unconstrained. In what the report calls a "Denial-of-Wallet" scenario, an AI agent entered a recursive reasoning loop after encountering a corrupted value.
In less than an hour, the agent generated more than 15,000 reasoning API calls, adding an estimated USD $50,000 in cloud costs. The same activity also caused database locking that disrupted business transactions.
Defence model
The report argues that static controls are insufficient for AI environments where software agents can act quickly across multiple systems. Instead, it recommends a defence model based on adaptive identity controls, continuous behavioural telemetry, and faster automated response.
Among its main recommendations is replacing long-lived service accounts with dynamic identities tied to workloads and cryptographic controls. The goal is to reduce the risks associated with persistent credentials that can be stolen, reused, or misapplied in automated environments.
Mandiant also called for tighter links between agentic AI systems and security operations centres. Security teams should combine telemetry from model prompt streams, endpoint runtimes, and application activity to spot unusual behaviour more quickly, the report says.
It also recommends feeding token usage telemetry, multi-application API activity, and helper logs into SIEM and EDR systems. That approach is intended to support automated memory snapshots and rapid containment when anomalies appear.
The broader warning is that traditional network and identity boundaries are becoming less distinct as AI systems gain wider access to tools and data. A compromised agent or assistant can therefore become a channel for code theft, remote execution, or sudden cost escalation.
The findings also show that many of the underlying attack methods are familiar, even if the targets are new. Session hijacking, repository poisoning, and credential theft remain central tactics, but AI workflows can amplify their reach and speed.
For companies deploying AI in software development or operations, the report presents a picture of rising operational risk alongside growing adoption. Organisations need to place technical guardrails directly in AI pipelines, monitor agent behaviour in real time, and give security teams the means to contain compromised workflows quickly.
The report concludes that as AI systems take on more autonomous work, defenders will need security controls that match their pace and scope rather than relying on protections designed for slower, human-led processes.