Cap every agent task at a break-even budget before it runs, then enforce that cap outside the agent. The September 2026 Hacker News report of a Codex task spawning 826 child agents and $79,664.88 in invoices, and Nvidia's September 28 Open Agent Safety Platform with its Sentry watchdog, both prove the rule from Ed Miller's The Logic of Sports Betting: the hold destroys your margin for error, so shrink the attack surface first.

I run agents that spend my money while I sleep, so the Hacker News post that went around this weekend read less like news and more like a letter from a possible future. The details matter, so here they are as the author reported them, not as the headline compressed them.

On July 10, 2026, a developer opened an ordinary Codex task from VS Code, model set to GPT-5.5 at medium reasoning, asking for a UX review of one module. According to his reconstruction, posted to Hacker News on September 26, 2026, that single root task produced 826 distinct child tasks, recorded as GPT-5.6 Sol at Ultra reasoning, that drifted from "inspect the UI" into backend infrastructure, OAuth, metering, hardening and release work. His billing history showed 162 paid invoices totalling $79,664.88, most of it automatic reloads of credits. The 584 children created under Codex build 0.144.0-alpha.4 averaged about 264 million local token counters each, roughly 8.5 times the average under build 0.144.2, which points at a bug in the alpha build rather than at the model. Two weeks into a support case, OpenAI's answer was that "credits were consumed." I want to be careful: this is one person's account, the local token counters are not OpenAI's billing ledger, and OpenAI has not published its side. But the shape of the failure is exactly the shape I worry about, and it does not require the numbers to be exact.

Two days later, on September 28, 2026, Nvidia announced its Open Agent Safety Platform, which Jensen Huang described on CNBC as "a browser for agents." It has two parts: OpenShell, a permission layer that runs on CPUs and limits what an agent can touch, and Sentry, a watchdog that runs on network chips, deliberately not on the CPUs or GPUs the agent itself uses. Nvidia's Justin Boitano put the principle in one sentence: "model-level safeguards alone can't govern what agents can access or do." Cisco, Microsoft, Oracle, CoreWeave, Dell, HPE, Lenovo, Arm and Intel signed on as partners, and Anthropic is integrating its managed agents with OpenShell. None of that ships to a solo founder's laptop this week. The design principle does.

The book I actually reach for here is not about AI at all. Ed Miller and Matthew Davidow's The Logic of Sports Betting has two ideas that map onto agent spend better than anything in the AI literature. The first is the hold: the sportsbook's built-in edge, typically around 4.5% on a major market, which Miller says "destroys your margin for error," because one bad bet out of five wipes out four good ones. Every agent task carries a hold, the tokens burned on retries, tool calls and reasoning that produce nothing you keep, and a runaway task is one bad bet that eats a year of good ones. The second idea is attack surface, a term Miller borrows from security: every extra market a sportsbook offers is a vulnerability because nobody can price hundreds of markets well at once. Every extra capability you leave open to an agent, spawning children, escalating models, reloading credits, is attack surface in the same sense. The Codex task did not need Ultra reasoning or 826 children to review a UI. Those were markets left open.

So here is the rule I have run since the Muse incidents this summer, tightened this week. I call it the Break-Even Agent Budget.

  1. Price the task in break-even terms before it runs. Miller converts every bet to a break-even percentage first. I convert every agent task to a dollar cap: what would I pay a competent human for this output? A UX review of one module is a $300 afternoon, so the agent gets 10% of that, $30, and I write the number down before I type the prompt.
  2. Close the markets you are not betting. Set the model and reasoning level explicitly and forbid escalation; cap parallel subagents at a number you could read the output of; and turn automatic credit reload off. In ChatGPT Business, only workspace owners can manage automatic reload, and monthly credit limits can be set per seat and per user, which is the right place for the cap, because it is outside the agent.
  3. Put the watchdog on different silicon. This is Nvidia's Sentry principle scaled down: the thing that stops the spend must not depend on the agent's own logs. In the Codex case, roughly 2,550 thread records survived with no execution history, so the agent's history could not even reconstruct what happened. My stop is a card alert at $50 a day and a provider-side spend limit, both of which fire whether the agent is honest or not.
  4. Size the bankroll, then run a postmortem on any 3x breach. Miller's bankroll rule is that even a real edge goes broke on variance without sizing. My agent budget is fixed at 3% of monthly revenue, and any task that exceeds three times its cap gets a written postmortem before I run that class of task again.

The limits are worth stating plainly. The budget rule cannot stop a bug in the vendor's client, which is what the 8.5x token jump between Codex builds suggests this was; it can only bound the damage. Turning off auto-reload means a legitimate long task will stall at 3 a.m. and you will have to restart it, which I accept. And the honest failure mode of my own rule is that I set caps generously on tasks I am excited about, exactly the way a bettor loosens sizing on a game he has a hunch about. Miller's answer to that is the one I keep taped above the monitor: if you cannot spot the sucker at the table, it is you.

Sources: Hacker News, "OpenAI Codex agents go rogue and consumes USD 78,000 without authorization," user report posted September 26, 2026 (news.ycombinator.com/item?id=49861047); CNBC, "Nvidia releases software platform to stop AI agents from misbehaving," September 28, 2026 (cnbc.com); OpenAI Help Center, "Managing credits and spend controls in ChatGPT Business," updated September 29, 2026 (help.openai.com); Ed Miller and Matthew Davidow, The Logic of Sports Betting (2019), chapters on the hold, attack surface and bankroll.

Related: How to Find Your Passion · Best Self-Improvement Books · How to Make Better Decisions · Why Exploration Is Important for Success