One runaway AI agent racked up a $50,000 cloud bill

Mandiant and GTIG report that autonomous AI agents and LLMs are being abused via prompt injection, poisoned models, and supply-chain compromises which can enable credential theft, internal reconnaissance, lateral movement, and even AI-developed zero-day exploitation; the report documents malware disguised as AI skills, incidents tied to UNC6780/TeamPCP, and red-team demonstrations of agent-driven exfiltration, and recommends governance, adaptive identity controls, real-time telemetry, and pipeline security to mitigate these risks.