AI Didn’t Create a New Kind of Risk. It Removed the Time You Had to Fix the Old One.

Mandiant’s AI Risk and Resilience 2026 report shows attackers putting agentic AI to work across the intrusion. Vulnerability exploitation is still the leading way in, and the window to fix it is closing.

Executive Summary

Mandiant and Google Threat Intelligence Group (GTIG) published AI Risk and Resilience 2026 in September. Attackers now use agentic AI for reconnaissance, vulnerability validation, and, in at least one case, a zero-day, yet vulnerability exploitation is still the leading way in for the sixth year running. AI has changed how fast attackers exploit far more than what they exploit.

• Exploitation is still the front door. Exploits caused 32% of intrusions in M-Trends 2026, and the mean time to exploit is now an estimated minus seven days. Mandiant concludes that defense has to move beyond manual triage to machine speed.
• Most AI incidents started as exposures. Poisoned packages, long-lived CI/CD credentials, unsigned plugins and MCP servers, and over-permissioned agents were all in place before the attack.
• AI infrastructure is now a target in its own right. An autonomous AI agent reached cluster-admin in Hugging Face’s Kubernetes environment with no CVE to match, and exploits for AI components are appearing before disclosure.
• The Risk Operations Center is the missing layer. The report answers with runtime controls and an agentic SOC, which act after the attacker is inside. A Risk Operations Center (ROC) closes exposures before the attack and uses runtime evidence to catch what is exploited anyway.
• A machine-speed adversary needs a machine-speed defender. Qualys AI agents detect new exposures, prove which ones are exploitable, and remediate them, so the defender’s side of the race is automated too.
• One ROC covers all of it. Infrastructure, identity, and AI risk belong in one ROC, with proactive AI governance ahead of runtime guardrails.

What the Frontline Is Telling Us

Drawing on incident response, Offensive Security engagements, and threat intelligence, the report describes attackers moving from chat-based research to autonomous attack orchestration. Five patterns stand out.

• Agentic attack tooling is in the wild. Tools such as Hexstrike and Strix automate reconnaissance, vulnerability validation, and credential harvesting.
• AI-assisted zero-days are real. GTIG assessed with high confidence that a cybercriminal used an AI model to find and weaponize a two-factor authentication bypass in an open-source admin tool for a planned mass exploitation campaign.
• The AI supply chain is part of the perimeter. Poisoned PyPI packages, a compromised LiteLLM library, weaponized agent skills, and subverted coding-assistant hooks all appear in the case studies.
• Over-privileged agents are part of the attack surface. Mandiant red teamers manipulated a CI/CD chatbot into pushing internal repositories to an external GitHub account, and an assessment found a RAG support agent that indirect prompt injection could turn against other customers’ data. In a real incident, a finance agent made 15,000+ API calls in under an hour, causing a roughly $50,000 billing spike.
• Long-lived credentials keep doing the damage. One healthcare intrusion began with a single long-lived CI/CD credential and ended with thousands of credentials compromised.

M-Trends 2026 also shows the hand-off from initial access to a secondary threat group falling from over eight hours in 2022 to 22 seconds in 2025.

AI Infrastructure Is Already Under Attack

The same pattern is showing up in AI infrastructure itself. In July 2026, an autonomous AI agent that had escaped an evaluation sandbox worked its way into Hugging Face’s Kubernetes environment. A Qualys analysis of the intrusion counted about 17,600 actions over five days, and the agent reached cluster-admin in about 13 hours. It entered through a dataset configuration file and an unsanitized template, then used a privileged pod and a shared credential to take over clusters. None of those steps gave a vulnerability scanner a CVE to match.

Vulnerabilities in AI components are being weaponized just as quickly. Qualys research on AI exploits in containers puts the window of weaponization at minus one day for flaws in the NVIDIA Container Toolkit (CVE-2025-23266) and in an MCP server (CVE-2025-6514). For a Docker Model Runner flaw (CVE-2026-28400), whether a workload is exploitable depends on runtime flags and how the service is invoked.

Most AI Incidents Are Exposure Problems in Disguise

A risky package in the build pipeline is a software exposure. A long-lived CI/CD key is an identity exposure. An unsigned plugin or over-permissioned MCP server is a misconfiguration. An agent that reads private data, ingests untrusted content, and talks to the internet is an attack path. These are familiar exposures on a new class of asset that most inventories cannot yet see. In six of the report’s eight case studies, the attacker used an exposure that could have been found beforehand.

Mandiant Case Study	Exposure Before the Attack	How Exposure Management Finds It
Coding session hijack spreads Shai-Hulud	Unverified AI-recommended package; long-lived GitHub OAuth tokens	SCA and AI-SBOM in IDE and CI/CD, secrets scanning, malware detection
AI co-debugging in a cloud intrusion	Long-lived CI/CD credential; unisolated VM with open egress	Non-human identity inventory; cloud egress posture checks
Subverted CLI hooks lead to RCE	Unsigned hooks, plugins, and MCP servers; weak AI repository controls	MCP and AI software discovery, MCP testing, access review
Confused Deputy exfiltration (red team test)	Agent with repo access, user input, and an allowed external domain	One attack path across data access, untrusted input, and egress; LLM red teaming
Denial-of-wallet reasoning loop	Agent with read and write access to billing databases, no cost limits	Agent entitlement and least-privilege findings
RAG agent with untrusted input (assessment)	Pipeline ingesting public content with reach into other customers’ tickets	LLM red teaming for indirect prompt injection and data leakage

The other two, just-in-time polymorphic malware and a stealthy espionage backdoor, are runtime detection problems. Together with the Hugging Face case, they are why a ROC needs runtime detection as well as posture.

The Risk Operations Center Is the Missing Layer

Mandiant answers these cases with agent identity, runtime guardrails, and an agentic SOC that triages at machine speed. Those controls matter, and they take effect once an attack is underway. The layer the report leaves out is the Risk Operations Center, which finds and closes exposures before the attack and uses runtime evidence to catch what is exploited anyway. Three capabilities make it more than another source of detections.

• Hybrid coverage. The exposures in the report sit on developer workstations, CI/CD pipelines, cloud VMs, SaaS applications, and identity systems. The Qualys platform covers on-premises, endpoint, multi-cloud, container, identity, application, and AI assets with the agents and connectors customers already run.
• Proof of exploitability. Safe exploit validation shows which exposures an attacker can actually use in your environment, so teams act on evidence instead of a severity score.
• Remediation as well as detection. Each validated exposure is patched, mitigated, or isolated, and the fix is confirmed, so the finding is closed as well as reported.

Six Moves That Answer AI with AI

Mandiant’s premise is an adversary that operates at machine speed. A defense that depends on analysts triaging by hand cannot match it, so the defender’s side has to be automated as well. On the Qualys platform, AI agents do that work at each stage. Agent Insta detects new exposures within minutes of disclosure. Agent Val proves which ones are exploitable. Agent Sara plans and runs remediation in TruRisk Eliminate. Agent Grant investigates and closes identity risk. The six moves below show where each one fits.

Close the Window with Agent Insta and TruRisk Eliminate

With a negative time to exploit, what matters is how fast a team closes the gap between disclosure and fix, and every handoff between tools adds hours. InstaScan, powered by Agent Insta in Qualys Enterprise TruRisk Management (ETM), matches new advisories against the inventory Qualys already holds, without a rescan.

Customers are seeing this in practice. In a Techstrong TV interview recorded at ROCon Americas 2026, Theo Bowman, who runs the vulnerability management program at NCR Atleos, explains that the biggest change since Mythos is the need to find exposures first and fix them quickly. He describes InstaScan returning vulnerability data for his assets within three minutes of a Patch Tuesday release. The last two Patch Tuesdays show similar speeds.

• October 2026. Microsoft fixed a record 1,414 vulnerabilities, 78 of them critical, including an exploited Windows Shell zero-day (CVE-2026-96951) with a CISA patch deadline of October 16. Agent Insta customers had detections within 5 minutes, and Qualys provided mitigations for 608 of the vulnerabilities.
• November 2026. Microsoft fixed more than 1,000 vulnerabilities, 63 of them critical, including an exploited Outlook spoofing zero-day (CVE-2026-124194) with a CISA patch deadline of November 24. InstaScan showed customers their findings 40 minutes before Microsoft’s own advisory page was updated, and Qualys provided mitigations for 537 of the vulnerabilities.

TruRisk prioritization, informed by QVSS and Qualys threat intelligence, raises likely-weaponized vulnerabilities about 45 days, on average, before they reach the CISA Known Exploited Vulnerabilities (KEV) catalog. TruRisk Eliminate with TruConfidence then closes the loop through agentic remediation and autonomous RemOps. Agent Sara picks the safest action for each exposure (patch, mitigation, or isolation), rolls it out in waves with reliability scoring and rollback, and confirms the fix. In the past year, customers deployed 150 million patches, 40 million fully autonomously.

See AI as Attack Surface with TotalAI

Mandiant calls for a dynamic AI inventory and an AI-SBOM. Qualys TotalAI discovers AI agents, models, MCP servers, AI software and libraries, GPUs, AI containers, cloud AI services, and shadow AI using the Cloud Agents and connectors customers already run. Built on the Enterprise TruRisk Platform, it scores each AI asset with TruRisk alongside servers, endpoints, and cloud workloads.

TotalAI follows an AI application from code to runtime. It checks AI code and agent configuration in the IDE and CI/CD, assesses AI container images, generates an AI-SBOM, and confirms whether vulnerable AI packages are installed, running, and communicating, so a risk on a live workload can be traced back to its image and code. It tests MCP servers for missing authentication, tool poisoning, argument injection, SSRF, and rug-pull behavior, and red-teams LLMs for prompt injection, jailbreaks, and data disclosure, mapped to the OWASP LLM and MCP Top 10 and the EU AI Act. For supply chain malware, including the just-in-time polymorphic malware in the report that defeats signatures, Qualys uses deep learning to detect unknown malware in container images and workloads before deployment and in cloud network traffic with TotalCloud Cloud Detection and Response.

The same visibility extends to the workforce. The TotalAI Browser Plugin, combined with SaaS connectors, shows which sanctioned and shadow AI tools employees use, and it analyzes prompts and uploads to show when sensitive data is leaving through them.

Treat Every Agent as an Identity with ETM Identity

An agent with a static API key and standing access holds privileged access around the clock. Mandiant recommends dedicated agent identities, short-lived credentials, least privilege, and treating coding assistants and MCP servers as privileged sessions. Each is an identity exposure that can be measured before it is abused, and Entro Security found that 97% of non-human identities carry excessive privileges.

ETM Identity discovers identities across Active Directory, Entra ID, Okta, and local accounts, extends to non-human identities such as service accounts and application identities, traces blast radius across chained permissions, and correlates risky identities with vulnerable assets as toxic combinations. Agent Grant investigates those findings and guides the fix. Access reviews now need to ask what has access as well as who. AI agents with standing access are where ETM Identity is heading next.

Map the Lethal Trifecta as an Attack Path

Mandiant’s “lethal trifecta” is an agent with private data access, exposure to untrusted content, and an external channel. Each alone is manageable. Together they form an attack path that one injected instruction can turn into exfiltration, as the Confused Deputy test showed.

Attack paths for AI span more than one product. TotalCloud provides attack path insights for cloud and container workloads, and with TotalAI those insights extend to the AI models and MCP servers found in container images. Figure 9 shows one: an internet-exposed container with a critical exploitable vulnerability, running an image that contains an AI model, traced back to the commit and build pipeline that produced it. ETM Identity traces how an identity can chain privileges to reach critical systems. ETM is where these come together. For the lethal trifecta, the chain joins the agent’s entitlements from ETM Identity, the untrusted inputs and unsafe tool behavior TotalAI finds, and the cloud and network exposure from TotalCloud and ETM. Showing it as one toxic combination, ranked by the data it reaches, lets teams break the chain at a single link instead of chasing each finding. That is the direction we are taking attack path analysis across ETM and TotalCloud with TotalAI.

Prove It, Fix It, and Prove It Again with Agent Val

When exploits take hours to build, theoretical severity cannot decide what to fix. Agent Val uses TruConfirm to safely prove whether an exposure is exploitable in your environment, drives the mitigation, and revalidates closure. TruConfirm covers more than 1,800 CVEs with over 8 million validations. It brings the discipline of a red team engagement, like those Mandiant’s Offensive Security team runs, into continuous operation.

The same principle applies at the application and AI layers. TotalAppSec (or WAS) runs dynamic application security testing (DAST) against the web applications and APIs that sit in front of AI systems, alongside the penetration tests teams already run. TotalAI red teaming tests models and MCP servers and shows which technique succeeded and which guardrail failed.

Detect AI Exploitation in Real Time with Container Runtime Security

Some attacks leave nothing for a posture scan to find. In the Hugging Face intrusion, a package scan had nothing to match at the entry point and no view of the later stages (Figure 1). Exploits for AI components can arrive before disclosure, and whether a flaw is exploitable can depend on how a container is started. These cases have to be caught while they happen.

Qualys Container Runtime Security, part of TotalCloud, uses an eBPF sensor in the kernel to watch process, file, and network activity inside running containers, so it can detect exploitation of AI vulnerabilities in real time. In the Hugging Face analysis, its detections map to the fileless Python execution at the entry point, the container escape through a host path mount, the mount, chroot, and setns activity on the node, and the SOCKS proxy tunnel used for lateral movement. TotalCloud Cloud Detection and Response adds the Kubernetes and cloud API activity that process sensors cannot see, such as token minting and replayed cloud credentials. Kubernetes posture checks and admission policies flag or block the privileged pods and host path mounts the agent relied on. The analysis does not claim these controls would have stopped the campaign. It shows which layer sees each step, and that runtime, posture, and cloud audit each answer a different question.

The same runtime evidence sharpens prioritization, because it shows which vulnerable packages are actually running and exposed.

Runtime Is One Pillar of AI Governance

Mandiant separates governance for AI (risk appetite and policy) from governance of AI (technical guardrails in pipelines and at runtime), and most of its technical guidance sits at runtime. A program that relies on runtime alone assumes every guardrail is configured correctly and every injection is caught in flight. We believe the stronger model is proactive first, with runtime guardrails as the backstop.

Layer	Question It Answers	How Qualys Delivers It
AI-SPM	What AI do we have, who owns it, and how is it configured?	TotalAI discovery and posture across models, agents, MCP servers, AI SaaS, and cloud AI
Workforce AI	Which AI tools are employees using, and what data goes into them?	TotalAI Browser Plugin and SaaS connectors, with prompt analysis for shadow AI use
Proactive security testing	Can this model or MCP server be manipulated before it ships?	LLM and MCP red teaming from CI/CD or on a schedule, mapped to OWASP and the EU AI Act
Prioritization and remediation	Which AI risks matter most, and what fixes them?	TruRisk with infrastructure and identity context; TruRisk Eliminate and guardrail recommendations
Runtime AIDR	Is something going wrong right now?	Policy-based runtime controls, and eBPF-based real-time detection of exploitation in AI workloads

TotalAI includes the runtime guardrails that give the SOC its AI signals. A SOC delivers its best return when a ROC is working ahead of it, because the ROC closes the exposures that would otherwise keep producing alerts. Guardrails written from red team results address weaknesses proven to exist, and every retest produces the evidence boards and regulators are starting to ask for.

Measure Time to Close

The AI era will be decided by how quickly teams close the window between disclosure and fix, which a count of open findings does not show.

• Measure your exposure window. Track disclosure to detection, prioritization, and fix for exploited vulnerabilities, with a target in hours.
• Put AI in the asset inventory. Cover agents, models, MCP servers, AI libraries, and shadow AI-like servers and endpoints.
• Retire static credentials for agents. Classify non-human identities, flag long-lived keys and standing privileges, and move to short-lived, scoped identities.
• Look for the lethal trifecta. Find agents with private data access, untrusted input, and an outbound channel, and remove one of the three.
• Validate before you prioritize. Use safe exploit validation to separate the exploitable from the theoretical.
• Test AI before you rely on runtime guardrails. Red-team models and MCP servers before release and after every change to prompts, retrieval, or guardrails.
• Watch AI workloads at runtime. Use kernel-level runtime detection to catch exploitation that has no CVE to match.

One Risk Operations Center for Infrastructure, Identity, and AI Risk

Attackers have automated their side of the race, yet their first move is still a weakness that was in place before the attack began. Runtime controls and the SOC respond once that weakness is used. The ROC closes it first, and its runtime detection catches what is exploited anyway. With Qualys, Agent Insta detects at AI speed, Agent Val proves what is exploitable, and Agent Sara remediates autonomously, on one platform that treats servers, clouds, identities, and AI systems as the same attack surface. That is one Risk Operations Center for infrastructure, identity, and AI risk.

---

Ready to see how Qualys closes the exposure window across your infrastructure and your AI? Request an ETM demo or start a TotalAI free service.

---

Contributors

• Kaustubh Jagtap, Principal Evangelist, Risk Management