Reference · 2026
Runaway AI Agent Spend: Failure Modes
How an autonomous agent actually runs away with money — the failure modes, the arithmetic that makes them expensive, and the caps that bound them.
By the sipi.bot engineering team · Published 2026-07-18 · Last updated 2026-07-25 · Methodology
What a runaway incident is
A runaway incident is an agent executing an action sequence — typically a retry loop or a tool-call chain — that spends beyond what the operator intended for that session. The agent did something the operator did not intend, and it cost money.
The four failure modes
These are the recurring shapes of runaway spend. They are engineering failure modes, not survey results, and each maps to a control that stops it before the spend happens:
| Failure mode | What happens | Control that bounds it |
|---|---|---|
| Retry loop on a failed tool call | One failing call is retried without a ceiling; each retry is billed | Velocity cap (max transactions per hour) |
| Prompt injection to an unintended vendor | Injected instructions redirect purchasing to an attacker-chosen destination | Allowlist + per-transaction cap |
| Unattended overnight session | No human is present to notice or intervene for hours | Daily total cap |
| Aggressive provisioning while debugging | Loosened limits during development are never tightened again | Environment-scoped rules |
The retry loop is the one worth designing for first: it needs no attacker and no unusual conditions, only a failing dependency and no ceiling.
Why the tail dominates
Runaway cost is not driven by the price of a typical task — it is driven by repetition. The arithmetic is simple enough to check against any provider's published rates:
- A task costing $0.34 is unremarkable. The same task caught in a 40-retry loop costs $13.60, and nothing about the individual calls looks wrong.
- A loop that runs unattended for eight hours is bounded only by rate limits and your balance — not by anything the agent knows.
- A per-transaction cap does not help here, because no single transaction is large. Only a velocity or daily total cap bounds it.
Work the numbers for your own stack with the spend calculator and the published per-model rates in ai-model-costs-2026.csv.
Methodology
What this page is based on: published provider pricing (rates each vendor lists publicly, captured in ai-model-costs-2026.csv), publicly reported incident write-ups, and the failure modes exercised by the open-source evaluation suite — 53 scenarios you can run yourself with pip install sipi-bot.
What it is not based on: any survey, and any customer or deployment telemetry. sipi.bot collects none — no telemetry is a design property of the product, not an oversight — so it is not in a position to publish incidence rates, median incident costs, or percentile distributions, and it does not.
If you have run into runaway agent spend and can share what happened, the repo is the place — real incident write-ups are worth more than an invented percentage.