How to Stop Runaway AI Agent Spend

The short answer: cap the run, not the month. Four controls stop a runaway agent: a spend ceiling attached to a single agent run and checked before each call is forwarded, a hard limit on steps and recursion depth, a kill switch keyed to the run ID, and enforcement in the request path rather than in a dashboard. Monthly budgets, provider spend limits, and alerting all fail here for one reason. They work on a timescale of days, and an agent loop works on a timescale of minutes.

Uber exhausted its entire 2026 AI budget four months into the year after rolling Claude Code out to roughly 5,000 engineers, with power users running $500 to $2,000 a month, as reported by Forbes. That case was human adoption outrunning a finance model. Autonomous agents remove the human, and with them the only natural brake.

Why agent spend breaks monthly budgets

A monthly budget assumes spend arrives smoothly: you watch the burn rate and intervene if the slope looks wrong. Agent spend arrives in bursts, and the size of a burst is set by how many times a loop iterates before something stops it.

The multiplier is well documented. In Anthropic's write-up of its multi-agent research system, the engineering team states plainly: "agents typically use about 4x more tokens than chat interactions, and multi-agent systems use about 15x more tokens than chats." The same post notes a complex research task "might use more than 10 subagents," while simple fact-finding needs one agent making 3 to 10 tool calls. The cheapest and most expensive shape of the same feature differ by two orders of magnitude, and which one you get is decided at runtime by the model.

The four ways an agent runs away

The loop that will not terminate. The agent calls a tool, reads a disappointing result, re-plans, and calls the same tool again. Nothing errors, and every call looks correct in your logs. The run never reaches a stopping condition, and it continues until something outside the agent stops it.

Retry storms. A provider returns a 429 or a 500, the client retries, and the retry re-sends the entire accumulated context. A brief provider degradation can multiply an hour of normal traffic several times over, and because each retry is a legitimate, billable call, error monitoring never flags it.

Context bloat. Every step carries the whole conversation so far, so the tenth call is far more expensive than the first even though it looks identical in your code. This is the mechanism behind the numbers in the next section.

Fan-out. One user action spawns subagents, each spawning tool calls whose results become input tokens. Tool results are not free context. Anthropic's pricing documentation puts a fetched research paper PDF at roughly 125,000 tokens. Three such fetches in one run is 375,000 input tokens before the agent produces a word of output, which is why that page recommends bounding fetch size with max_content_tokens.

Why cost outruns step count

In an agent loop, every step re-sends the whole conversation so far. Step 12 pays for the output of steps 1 through 11 all over again, as input. Cost therefore grows with roughly the square of the number of steps, not in proportion to them.

Take a loop where the system prompt and tool definitions total 2,000 tokens, the agent emits about 500 output tokens per step, and each tool result adds about 1,500 tokens to the history. History grows by 2,000 tokens per step, so the input at step N is about 2,000N tokens, and the cumulative input across N steps is 1,000 x N x (N+1). Priced on Claude Opus 5 at $5 per million input tokens and $25 per million output tokens (current published rates):

Steps	Cumulative input	Cumulative output	Run cost
10	110,000	5,000	$0.68
20	420,000	10,000	$2.35
30	930,000	15,000	$5.03
50	2,550,000	25,000	$13.38

Five times the steps is roughly twenty times the cost. A step limit of 50 is not five times more permissive than a limit of 10; it is twenty times more expensive in the worst case. Now apply fan-out: ten subagents each running 30 steps is a little over $50 for one user action, from a workload where no single call cost more than a few cents.

Prompt caching helps but does not remove the curve. Cache reads bill at 0.1x the base input rate, so a well-cached loop flattens the constant and keeps the shape, and a cache written but never read is pure overhead at 1.25x or 2x. Anthropic also notes that Claude 4.7 and later models use a newer tokenizer producing "approximately 30% more tokens for the same text," so an identical run on a newer model can cost more with no change on your side.

What providers and SDKs already give you

Some real controls exist. None of them is a per-run financial ceiling.

Control	What it bounds	Where it stops short
max_tokens	Output of one call	Nothing about how many calls a run makes
max_turns in the OpenAI Agents SDK	Iterations of one agent loop, raising MaxTurnsExceeded	Counts steps, not dollars. Thirty steps on Opus with long context is not thirty steps on Haiku. It can also be disabled with max_turns=None
OpenAI spend limits	Organization or project spend	No concept of a run, an agent, or a customer. Tripping it stops everyone
Anthropic workspace caps	Monthly spend per workspace	Monthly granularity against a failure that completes in minutes
Dashboards and alerts	Nothing	Reports spend that already happened

Set a step limit anyway. It is simply the wrong unit: engineers reason in steps, invoices are denominated in dollars, and the conversion is decided at runtime by context length and model choice, which is exactly what a step limit cannot see.

The four controls that actually stop a run

1. A run ID on every call in the run. Nothing else works without this. Every model call caused by one user action carries the same identifier, set server-side. Without it, a $50 runaway looks like 300 unrelated $0.17 requests, and no aggregate will flag it.

2. A spend ceiling per run, evaluated before the call is forwarded. Spend accumulates against the run ID and is compared to the ceiling before each request goes to the provider. A run at its ceiling is refused; every other run continues untouched.

3. Step and depth limits. Cheap, coarse, and worth having as a second line. Bound loop iterations and how deep subagent spawning may nest.

4. A kill switch keyed to the run ID. One operation stops that run's future calls, without a redeploy and without touching other traffic.

With an in-path setup, the integration is a base URL change plus metadata injection for full attribution. The run ID rides on every call in the run, and the ceiling is enforced before the request reaches the provider:

import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://www.spendline.ai/v1",
  apiKey: process.env.OPENAI_API_KEY,
  defaultHeaders: {
    "x-spendline-key": process.env.SPENDLINE_API_KEY,
  },
});

// Every call in this run carries the same agent ID, so spend
// accumulates against the run and can be capped before forwarding.
for (const step of agentLoop) {
  const response = await client.chat.completions.create(
    { model: "claude-opus-5", messages: step.messages },
    {
      headers: {
        "x-customer-id": account.id,
        "x-workflow-id": "research_agent",
        "x-agent-id": agentRun.id,   // the run-scoped budget key
      },
    }
  );
  // A run over its ceiling returns 402 before any provider call is made.
}

If a call can reach the model without passing the point where the run's accumulated spend is checked, the ceiling is advisory. Coverage has to be structural, which is the argument for enforcing on the network path rather than in each codebase.

Where this connects to enforcement and close

A per-run ceiling is one scope in a hierarchy. The same check runs at the organization, team, agent, and customer levels, and the right response differs by scope: block a looping agent, because that is a bug, but treat blocking a paying customer as a commercial decision. The scopes, the block versus reroute versus approval choice, and the concurrency race that lets simultaneous calls share one stale spend baseline are covered in LLM budget enforcement.

A run ceiling is also only as good as its run ID, and IDs or timestamps accepted from the client are spoofable inputs to a financial control. The metadata contract is in how to track LLM costs per customer. Once runs are priced records, an expensive run is a line you can investigate at month end rather than an unexplained gap against the invoice, which is the workflow in the AI month close. Per-model rates and the multipliers stacked on them are in Anthropic API pricing.

Common failure modes

• No run ID. The most common gap. Every other control depends on it.
• Step limits treated as spend limits. Steps are not dollars, and the conversion moves with context length and model.
• Caps that exist only in the agent framework. A retry wrapper, a cron job, or a second service calling the provider directly is not covered.
• Retries counted as one call. Treat a retried request as a single event and retry storms are invisible in the numbers meant to catch them.
• Advisory mode left on. A cap that logs what it would have blocked is a report. Useful for a week of calibration, dangerous as a steady state.

FAQ

Why do AI agents cost so much more than chat? One user action becomes many model calls. Anthropic reports agents using about 4x the tokens of chat interactions and multi-agent systems about 15x. Each step also re-sends the accumulated history, so cost grows with roughly the square of the step count.

Does setting max_tokens stop runaway agent spend? No. It caps one response. A runaway is a volume problem: hundreds of individually well-behaved calls. You need a ceiling on the run.

What is a per-run budget? A dollar or token ceiling attached to one agent run via a run ID carried by every call in that run, checked before each call is forwarded. The run is refused at its ceiling; other traffic is unaffected.

Why are provider spend limits not enough for agents? They apply to organizations, projects, or workspaces, and they are monthly. A limit high enough not to disrupt normal traffic cannot catch one looping agent, and a limit low enough to catch it takes everything else down too.

Can you catch a runaway agent with alerts and dashboards? Not in time. An alert describes spend that is already on the invoice. Detection has to happen in the request path, before each call is forwarded.

Sources and method

Written from building and operating Spendline's AI spend governance proxy, combined with public sources: agent token multipliers and subagent counts from Anthropic's multi-agent research system engineering post; model rates, cache multipliers, tokenizer changes and fetched-content token sizes from Anthropic's published pricing documentation; loop controls from the OpenAI Agents SDK documentation; provider limits from OpenAI's spend limits guide and Anthropic's workspaces documentation; the budget-exhaustion case as reported by Forbes. The worked cost table is our own calculation from the stated assumptions at published Claude Opus 5 rates; check current prices before relying on it. The four-control framing is our judgment. Last updated: August 2026.

---

Spendline is an AI spend control layer: point your provider base URL at Spendline and attach customer, workflow and agent-run metadata, and every routed call becomes a priced, append-only record with budgets enforced before the provider call. Want to know how your current setup scores? Take the 5-minute AI spend control assessment.