Guardrails & Control · 2 min read
How much can a runaway agent burn in an hour?
A single misbehaving agent loop doesn't fail loudly — it succeeds, thousands of times, at full price. We ran the numbers.
By Akhil Anand · September 5, 2026
The scary thing about a runaway agent isn't that it crashes. It's that it doesn't. Every request returns 200 OK. The tokens are real, the responses are valid, the bill is enormous. Failure would be easier — failure you'd notice.
The math of a quiet loop
Take a modest agent: a premium model, an 8K-token context, re-injecting its own history every turn. Suppose a logic bug makes it retry a step in a tight loop instead of advancing.
context: ~8,000 input tokens, growing each turn
output: ~1,000 tokens/turn
rate: ~3 calls/second (well within provider limits)
model: a premium reasoning model
At a few requests per second, that's ~10,000 calls per hour. At premium pricing, a single looping agent can burn hundreds of dollars an hour — from one user, on one endpoint, with zero errors in your logs. Multiply by a handful of affected sessions and you've lost a month's margin before lunch.
Your provider bill will tell you this happened. It will tell you tomorrow. The whole game is finding out in the next 60 seconds instead.
Detection is a behavior problem, not a rate problem
Naive rate limits don't catch this, because the traffic often looks legitimate — it's under the RPS ceiling and every call is well-formed. The signal isn't volume; it's behavior:
- Fingerprint repetition — the same model + near-identical input tokens, over and over.
- Monotonic context inflation — input growing on a consistent curve (re-injection).
- Temporal density — those repeats packed into a tight window, not spread across a session.
A legitimate multi-step workflow calls different models with varying payloads. A runaway loop calls the same model with the same shape, fast. That difference is detectable in real time.
Stopping it before the invoice
Detection only matters if you can act. The pattern that works:
- Detect the loop from live telemetry (behavioral fingerprint, not just RPS).
- Enforce at the edge — block or throttle the offending key before the next provider call, not after.
- Auto-recover on a timer, so a false positive costs minutes, not a support ticket.
Runaway agents are the loud, rare version of a quieter truth: AI cost is an operational risk, and the only place to stop it is before the request leaves your infrastructure.