The Agent Failed Once. The System Authorized 14,999 More Attempts.

An agent can begin an action legitimately and become unauthorized to continue when the state changes.

Mandiant’s 2026 AI Risk and Resilience report describes a global financial-services company that deployed an agent to reconcile accounting-ledger anomalies. The agent had direct read/write access to internal billing databases. When a corrupted null value broke a formatting tool, the agent entered an unconstrained recursive reasoning loop and repeatedly attempted to repair the problem.

In under an hour, Mandiant reports, the agent generated more than 15,000 high-frequency, high-cost reasoning API calls, created approximately $50,000 in cloud charges, and caused severe local database locking that halted active business transactions.

The original delegation was not the whole problem

The agent was authorized to reconcile ledger anomalies. That authority may have been legitimate at the beginning of the task.

But every failed attempt created new evidence. After repeated failures, the operational state was no longer “routine reconciliation.” It had become “runaway failure affecting cost and transaction availability.”

The system did not convert that new state into a new authority state.

Authority should change when the context changes

GovKM maps the loop as Authority / reconcile ledger → Context / corrupted value → Decision / retry → Action / API call → Evidence / repeated failure → Context should change → Authority should narrow or suspend.

Instead, the initial permission remained effectively valid through thousands of retries.

This suggests a stronger delegated-authority model: authority should be state-dependent, not merely identity-, scope-, and time-dependent.

Failure thresholds are governance boundaries

A continuity-aware agent runtime should be able to transition:

Task Active → Failure Threshold Reached → Authority Suspended → Human Review.

Cost ceilings, bounded recursion, transaction-impact thresholds, error-rate limits, and repeated-failure counts are not just engineering controls. They determine when the institution withdraws or narrows delegated authority.

GovKM interprets the Mandiant case as direct evidence that operational state must participate in authority.

Source

Google Cloud / Mandiant, “Mandiant AI Risk and Resilience Report 2026,” September 2026, Case Study 6: “Denial-of-Wallet using rogue reasoning loop.” https://cloud.google.com/security/resources/ai-risk-and-resilience-2026