Off-Hours Billing Activity Spike

Agents billing outside their normal operating hours is suspicious. A 3x increase in off-hours activity compared to baseline may indicate compromise or misconfiguration.

Sipi Bot flags off-hours spikes for human review. If compounded with other anomalies (new endpoint, different response size), the agent may be automatically paused.