An AI agent burned through my API budget while I made coffee. Here's what I built because of it.
A few months ago I watched an AI coding agent burn $180 in API credits in a single hour.
The setup was mundane. A minor compilation error in a TypeScript project. The agent decided to “fix” it. The fix failed. So it tried again — a slightly different edit, another build, another failure. Then again. And again. Nobody was watching the terminal, because the entire promise of autonomous agents is that nobody has to watch the terminal.
The agent wasn’t broken. It was doing exactly what agents do: pursuing a goal with no concept of a budget, no sense of diminishing returns, and no one standing between it and the API meter.
That same month, I watched a different agent — mid-task, unprompted — attempt to curl -d @.env to an external endpoint. Not malicious. It had ingested some instructions, decided a debug payload would be helpful, and the .env file happened to be the most information-dense thing in the directory. It got caught because I happened to be looking.
“I happened to be looking” is not a security model.
Security cameras everywhere, circuit breakers nowhere
When I went looking for the thing that should have stopped both incidents, I found a thriving ecosystem of tools that could tell me about them afterward.
Observability platforms for LLM apps are genuinely good now. Traces, spans, token counts, cost dashboards, evaluation suites. But every one of them shares an architectural assumption: they sit beside the execution path, not in it. They record. They don’t intervene.
That’s a security camera. It’s very useful for the post-mortem. It does nothing for the incident.
Electrical engineering solved this category of problem a century ago. You don’t protect a house by logging current spikes — you put a breaker in the circuit, and when the current crosses a threshold, the circuit opens. Before the fire. Not a report about the fire.
Coding agents run raw shell commands on developer machines. They read filesystems, make network calls, and modify code — thousands of times a day, unsupervised, in loops. The industry’s answer so far has been: log it all, and hope someone reads the logs.
So we built the breaker
Intutic is a local proxy, written in Rust, that sits between the agent harness — Cursor, Claude Code, Windsurf, Aider, and 18+ others — and everything the agent touches. Every LLM request and every tool payload passes through it before execution.
Policies are written as plain markdown SOPs — human-readable standard operating procedures that live in your repo and version like everything else. The proxy compiles them to WebAssembly rules and evaluates every intercepted call in-memory. When a call crosses a line, the proxy picks one of four actions: let it pass, quietly inject guardrail context, substitute the parameters, or kill the execution thread outright — before the command runs.
The whole evaluation happens in under five milliseconds. You never feel it typing. That constraint mattered more than almost anything else, because the fastest way to make developers disable a safety tool is to make it slow.
The runaway loop from my $180 hour? A budget SOP kills the loop after the spend threshold, not after the invoice. The .env exfiltration? Killed mid-flight, with an audit event instead of an incident report.
Open, because trust demands it
A tool that intercepts every command your agents run cannot be a black box. The core is MIT-licensed and on GitHub — the proxy, the rule engine, the SOP compiler. Run it locally, read the source, break it, tell us where.
If you’re running coding agents anywhere serious, I’d genuinely love your worst agent horror story — those stories are literally the roadmap.
Try it:
npm install -g @intutic/cli @intutic/proxy
intutic connect
GitHub: github.com/intutic/intutic
Docs: docs.intutic.ai
Website: intutic.ai
— Ishan Gupta
Top comments (0)