How do I stop an AI agent from running up my bill overnight?

By Ramin Moradi · Published 1 November 2026 · Sources checked 31 October 2026

Put a hard monthly spend limit on the model provider account, cap how many steps one agent run can take, and keep a person approving anything that spends money or reaches a customer. Alerts alone do not stop traffic. Without those three, a looping agent can keep calling paid APIs until morning.

Why does an AI agent burn money while you sleep?

An automation that follows fixed steps is usually bounded: one trigger, a short path, then stop. An AI agent lets a language model choose some of the next steps. That flexibility is useful. It is also how a vague job with paid tools turns into a loop: retry, search again, call another tool, retry.

I build and harden this class of system for clients (Laravel and JavaScript services, Docker and Kubernetes, CI/CD, Terraform, cloud migrations). The pattern that fails overnight is almost always the same: the agent can call a billed API, nothing caps monthly spend, and nothing kills a run that keeps failing the same step.

OWASP's 2025 LLM Top 10 names the money side of this Unbounded Consumption. One of their examples is Denial of Wallet: a high volume of operations against a cost-per-use cloud AI service that drives unsustainable cost. You do not need an attacker for that. A buggy retry loop on your own key does the same job.

How do you cap OpenAI API costs: spend alert or hard limit?

OpenAI's spend-limits documentation draws a clean line:

• A spend alert sends a notification. API traffic continues.
• A hard spend limit makes affected API requests return a 429 error with organization_spend_limit_exceeded or project_spend_limit_exceeded once tracked spend reaches the amount you set.

Spend alerts do not enforce a cap. If you only set an alert, the overnight loop still runs. OpenAI also says enforcement is not instantaneous, so recorded spend can slightly exceed the configured amount. Set the hard limit below the number you are willing to lose in a bad night, not at the absolute ceiling.

Anthropic documents the same idea for the Claude API: spend limits set a maximum monthly cost an organization can incur, and you can set your own spend limit below your tier's cap. When usage reaches a limit you set, requests stop (Anthropic returns HTTP 400 with a usage-limits message). Rate limits (requests over time) are separate from spend limits (money).

Do both on every project that runs agents: provider hard spend limit, and an app-level run budget so one job cannot chew the whole monthly cap alone.

What does OWASP recommend for unbounded consumption?

OWASP LLM10:2025 lists mitigations that map cleanly to agent builds. The ones that matter before you leave an agent overnight:

• Rate limiting and user quotas
• Timeouts and throttling for heavy operations
• Resource allocation so one request cannot consume everything
• Sandboxing that restricts which networks, tools and APIs the model can reach
• Logging, monitoring and anomaly detection on resource use
• Limits on queued actions and total actions

You do not need every item on day one. You do need a hard stop on money, a max step count per run, and a short allow-list of tools. If the agent can browse, send mail, create cloud resources or call paid APIs with no ceiling, fix that before you tune prompts.

Which guardrails belong in the automation itself?

Provider caps catch spend at the billing edge. The automation still needs its own brakes, because a single runaway job can burn most of a monthly cap before the provider limit trips.

On paid AI automation work we write into the scope:

1. Spend limits agreed up front, so a runaway job cannot run up a bill.
2. A person approves outbound messages and any change that is hard to undo.
3. Failures stop the run and get flagged, instead of silent retries until morning.
4. A written allow-list of tools and data the automation may use.
5. Untrusted input from forms and email that must not steer the automation into new paid actions.

The client dashboard shows usage against the limit you set, plus a pause switch. That is the operational half: you can see a spike and stop it without waiting for the next invoice.

If you are still pricing the first automation rather than hardening one that already runs, the cost breakdown lives in AI automation for small businesses: what it costs. This post is only about stopping overnight burn.

What should you check tonight before you leave an agent running?

Work through this list once. Skip anything you already enforce in production.

1. Provider console: hard monthly spend limit on, for the org and for the project that owns the agent keys. Alert thresholds below that limit.
2. Keys: the overnight job uses a project-scoped key, not the org-wide admin key.
3. Agent scope: max steps / max tool calls per run, with a hard abort when the counter hits the ceiling.
4. Tools: paid or irreversible tools (payments, provisioning, outbound email) require human approval or are disabled for unattended runs.
5. Retries: failed steps do not infinite-retry. Cap attempts, then flag and stop.
6. Monitoring: a usage or cost alert that wakes someone before the hard limit, plus a pause switch you can hit from a phone.
7. Written "must never do" list in the scope, including cold outbound and unsupervised spend.

If any of those are missing, leave the agent off overnight. A morning backlog of queued approvals is cheaper than a morning invoice you did not plan for.

FAQ

Will a spend alert stop an AI agent overnight?

No. On OpenAI, a spend alert notifies you and traffic continues. Only a hard spend limit stops affected requests (with a 429 and a spend-limit-exceeded code). Anthropic's documented spend limits also stop requests once your configured monthly cost is reached.

Is rate limiting enough?

Rate limits slow how fast calls can run. They do not set a money ceiling. OWASP lists both rate limiting and resource controls under Unbounded Consumption. Use rate limits and a hard spend cap together.

What is Denial of Wallet?

OWASP's Unbounded Consumption entry describes Denial of Wallet as high-volume operations that exploit pay-per-use cloud AI pricing and drive unsustainable cost. The same failure mode appears when your own agent loops on a billed API without a cap.

Should the agent approve its own paid actions?

No. Keep a person on anything that spends money, reaches a customer, or is hard to undo. The model can draft and sort. A human clicks send or approve.

Does Automation Lite include spend limits?

Automation Lite is free: we set up a free automation for you, and you manage it on our platform at no cost. Spend limits agreed up front are part of how we scope paid automations. Either way, set hard limits on your own model-provider account before any unattended run.

What if the hard limit already tripped?

OpenAI says raising or removing the reached limit lets traffic resume after the update propagates; otherwise it resets with the next monthly cycle. Check the error code first so you know whether you hit a configured spend limit, an OpenAI-approved usage limit, or empty prepaid credits. Fix the loop before you raise the cap.

What to do next

Turn on a hard spend limit in your model provider console tonight, then write max steps and human approval into the agent scope before the next unattended run. If you want help scoping those guardrails into an automation you can pause from a dashboard, book a free 30-min assessment.