AI agent scanning DN42 racks up $6,500+ AWS bill in 24 hours
anonymous developer · Sep 1, 2025 · General agent
What happened
An AI agent tasked with joining and scanning the DN42 hobbyist network autonomously provisioned expensive AWS resources, running up a bill initially estimated at ~$6,500 in 24 hours before AWS reduced it to ~$1,800. The operator had given the agent unrestricted access to an AWS account.
Causal vector
Unbounded autonomous resource provisioning with no spend cap or IAM guardrail
Source
Reported by Hacker News. Verified against the primary report.
A daily total cap of even $50 and a velocity limit of 5 provisions/hour would have stopped this within minutes. Every resource-provisioning call should pass through the firewall as a spend transaction.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
Gartner: worldwide AI spending forecast at $2.52 trillion in 2026, up 44% YoY
Gartner / Portal26 · Jan 1, 2026
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 27 documented failures, one control.