How do you stop an AI agent from running up a giant bill overnight?

How to stop an AI agent from burning your budget overnight

Set a hard dollar budget per workflow at the SDK layer (TokenFence or a LiteLLM/Portkey gateway), wire a kill-switch on iteration count, route default work to a cheaper model like Sonnet or Haiku, and review the run log every morning. As Robert Iger writes in The Ride of a Lifetime, you have to do the homework — agents do not.

This is the failure mode nobody warns you about when they show you their slick autonomous-agent demo. The agent that ran fine on Tuesday gets handed a task it cannot finish on Friday evening, enters a quiet retry loop, and you find out on Monday because Anthropic emailed you a bill. I have watched this happen twice on my own infrastructure and read enough public post-mortems in the last month — a Hacker News thread from June 12 where an autonomous agent literally bankrupted its operator while trying to scan the DN42 network, a fintech team that burned $14,000 over a weekend on a code-review agent stuck in a retry storm, a multi-agent system that ran up $47,000 before anyone noticed — to know it is now the default failure mode of agentic software.

The mechanism is always the same, and it is worth understanding before you reach for tools. A normal microservice fails loudly: it returns a 5xx, latency spikes, your dashboards go red. An agent fails semantically. It returns HTTP 200 the whole time. The orchestrator asks for a JSON report, gets one with a missing comma, the parser throws, the agent dutifully says "you returned invalid JSON, please fix and return the full report," the model hallucinates the same error, and the loop runs four times a minute at roughly eleven dollars an iteration. Everything is green. Your CPU is idle because the model is doing all the work. Only your invoice tells the truth.

So what actually works. The single highest-leverage move is putting a hard dollar cap at the SDK layer, not at the provider dashboard. OpenAI and Anthropic both expose monthly spend limits, but monthly granularity is the wrong unit when a single bad task can spend a month's budget in three hours. Wrap your client with something that enforces per-workflow and per-agent budgets — TokenFence is the cleanest two-line option I have seen, and a LiteLLM or Portkey gateway gives you the same control if you are already running a proxy. The shape that matters is: research_agent gets two dollars, writer_agent gets one, anything that hits the ceiling either downgrades to Haiku or stops. Layer two is an iteration counter on the agent loop itself — a hard "if I have called the model thirty times on the same goal, stop and surface" — because dollar caps catch the spend but loop caps catch the bug.

The second move is model routing as a default, not as an optimisation. Claude Opus 4 costs about five times what Sonnet does per token, and for eighty to ninety percent of real agentic work — file reads, tool calls, summaries, plain reasoning — Sonnet is indistinguishable from Opus in output quality. Ethan Mollick's rule from Co-Intelligence applies here in reverse: always invite the AI, but invite the cheapest one that can do the job, and only escalate to the frontier model when you actually see it fail. I default every background task on my own agents to Sonnet and reserve Opus for the handful of architecture-level decisions where the extra reasoning is visibly worth $0.30 instead of $0.06.

The third move is the one most founders skip because it feels unsexy: read the logs every morning. Five minutes. Look for tasks that consumed more than ten times the median tokens for their type. That is your runaway signal. Robert Iger writes in The Ride of a Lifetime that you have to do the homework — there is never a hundred percent certainty, but a lot of the bad outcomes come from people who skipped the prep. Agents are exactly the same. They will not tell you they are stuck in a refactor loop trying to pour a gallon of water into a pint glass; you have to look.

And one honest limit. Even with all of this — dollar caps, iteration caps, cheap defaults, daily review — you should still expect to lose money to a runaway agent at least once. Plan for the loss the way an early-stage founder plans for a bad hire: it is the cost of running this software at all, not a sign you got it wrong. The €0.01 bunq exploit that surfaced this month, where a one-cent transfer compromised a banking AI assistant, is a reminder that the failure surfaces keep moving. Build the guardrails, keep the kill-switch within reach, and stay in the loop. That is the whole job.