How to Prevent Runaway AI Agents
A runaway AI agent is an agent that keeps spending after it should have stopped — a retry loop, a prompt injection, or an unattended overnight session. It can spend $12,400 in 90 seconds. The fix is not a better prompt. It is pre-spend controls that halt the agent before the wallet drains. Here is the 5-step playbook.
The three causes of runaway agents
| Cause | Share | Example |
|---|---|---|
| Retry loop on failed tool call | 44% | Agent retries a paid API 40 times in 90 seconds |
| Prompt injection / instruction re-routing | 23% | Injection routes spend to attacker-controlled vendor |
| Unattended overnight session | 18% | No human available to intervene at 3am |
| Other (config error, model drift) | 15% | Misformatted call, unexpected model behavior |
The 5-step playbook
1 Install a velocity limit (retry-loop killer)
The #1 cause of runaway agents is a retry loop: a tool fails, the agent retries, each retry is a paid call. A velocity rule caps the number of transactions per window and blocks the Nth attempt — the loop dies before the wallet does.
{"rule_type": "velocity", "params": {"max_count": 10, "window_minutes": 60}, "action": "BLOCKED"}This single rule prevents 44% of runaway incidents.
2 Add a circuit breaker
A circuit breaker is a hard stop: when a daily or weekly threshold is crossed, the breaker trips and the agent is paused until a human resets it. Unlike a per-call cap, it stops all future transactions in the window. This converts a multi-thousand-dollar incident into a five-minute review.
{"rule_type": "circuit_breaker", "params": {"daily_ceiling": 200}, "action": "BLOCKED"}3 Set a timeout guard
Cap the wall-clock time per task so an agent cannot loop forever. A timeout of 5 minutes per task is reasonable for most agents; for long-running research agents, 30 minutes. The timeout should be a hard kill — not a suggestion — so the process actually terminates.
{"rule_type": "timeout", "params": {"max_seconds": 300}, "action": "BLOCKED"}4 Configure a kill switch
Give a human a one-call way to halt the agent immediately when an incident is detected. The kill switch should (a) stop the agent process, (b) revoke its payment method access, and (c) log the halt with a timestamp and reason. Without a kill switch, "stopping" a runaway agent means SSHing into a box at 3am.
5 Lock down business hours
Block or flag agent spend outside business hours. 18% of runaway incidents happen during unattended overnight sessions — a time-window rule ensures a human is in the loop when it matters.
{"rule_type": "time_window", "params": {"allowed_hours": "9-18"}, "action": "FLAGGED"}What you get
With these five controls, your agent cannot:
- Retry a paid call more than 10 times in an hour.
- Keep spending after crossing the daily ceiling.
- Loop forever on a single task.
- Continue running after a human hits the kill switch.
- Spend outside business hours without a human reviewing it.
Every decision is written to a tamper-evident audit log, so a post-incident review can reconstruct exactly what happened and why.
Frequently asked questions
How do I stop a runaway AI agent?
Install a velocity limit, a circuit breaker, a timeout guard, and a kill switch. The combination prevents an agent from spending thousands before a human notices.
What causes a runaway AI agent?
Retry loops (44%), prompt injection (23%), and unattended overnight sessions (18%). All three are preventable with pre-spend controls.
How fast can a runaway agent spend money?
Fast — 40 paid calls in 90 seconds. Worst observed incidents exceed $12,000.