Home/ Incident database/gemini-cli-47m-tokens-2025-07
Financial loss Runaway loop verified

Gemini CLI's autonomous tool loop silently consumed 47 million tokens on a five-file refactor

Individual developer (google-gemini/gemini-cli discussion 4841) · Jul 25, 2025 · Coding agent

What happened

A developer using Gemini CLI with a paid Vertex AI API key asked it to refactor a few test files. The CLI's default autonomous agent mode ran a reason-act-observe loop, calling ReadFile and Shell tools to gather context and re-sending the entire growing history on every request. The session logged 251 requests consuming 47,185,013 input tokens on gemini-2.5-pro - which the reporter priced at roughly $940 at a conservative $20 per million tokens. When the account hit its tokens-per-minute limit, the CLI displayed a misleading error about the AI Studio free daily quota, masking the real problem. A follow-up session consumed another 721,943 input tokens in under 14 minutes of wall time.

$940
Loss / impact
Jul 25
2025
Runaway
Failure mode
Coding
Agent type

Causal vector

Autonomous tool-use loop with full-history re-sends on every request; exponential context growth hidden from the user, attached to a paid API key with no spend ceiling

Source

Reported by GitHub discussion, google-gemini/gemini-cli 4841. Verified against the primary report.

Read the original report ↗

How a spend firewall would have helped

47 million tokens for a five-file refactor is a 1,000x anomaly, not a workload: a spend firewall with a per-task token ceiling and a repeated-call velocity bound returns BLOCKED on the request that crosses it, instead of letting a context-growing loop bill the account 251 times.

The six rule types that contain this class of failure

Per-transaction cap

Any single spend above your ceiling is BLOCKED before it moves.

Daily total

Cumulative spend across all agent calls, bounded per day.

Velocity limit

Stops runaway retry loops — the #1 cause of overnight losses.

Merchant allowlist

Only approved destinations can ever receive funds.

Category rules

Flag high-risk classes (crypto, infra, refunds) for review.

Approval threshold

Above a value, the action waits for a human.

Related incidents

Don't be the next entry

Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 71 documented failures, one control.