Everyone measures AI agent spend. Almost nobody stops it. I spent two weeks in GitHub issues, bug trackers and Show HN threads reading what actually happened to people, and the failures are far more repetitive than I expected.
The scale first, so this isn't abstract. One report: 416 API calls and 112,057,985 input tokens in a single session. Nine of that user's ten sessions ended in failed, and several kept firing calls for 20 to 23 hours after the point of failure. The dashboards worked perfectly the whole time.
Failure one: the gate passes, then the call changes.
The budget check runs against the model you asked for. Then a fallback or a router sends the request to a different deployment, and that one bills. From litellm #41344: "Nothing re-checks budget on the deployment that actually bills." The check was correct and irrelevant.
Failure two: everyone checks at once.
Five sub-agents each read the remaining budget. All five see headroom. All five proceed. Every individual check passed and the total is over the ceiling. A Cisco security spec puts it exactly: "multiple agents can observe remaining budget and start model calls before the governor's next poll."
This one is nastier than it looks, because it only appears under concurrency, which is precisely when you're not watching.
What connects them: both are a gap between deciding and spending. Anything that reads a number and then acts on it loses that race. The fix is the same shape banks have used for decades on card authorisations: claim the worst case before the call, settle to the real number after it returns. You over-reserve slightly and you cannot overspend.
That's what I'm building, as a library that sits in the process and refuses the call rather than reporting on it.
The question I keep asking everyone, because the answers keep surprising me: besides cost, is there anything you'd want an agent blocked from doing outright? Tools that write, external actions, specific models? Or is cost the whole of it for you?
Top comments (0)