AI agents are burning real money.
Here's every documented case.
An open registry of runaway-spend incidents caused by autonomous AI agents — $183,636+ in documented losses across 14 sourced incidents. Each one maps to the exact spend rule that would have stopped it.
Runaway agent spend is a documented, recurring failure mode — not a hypothetical. This registry makes every case citable, and maps each to the one rule that would have prevented it. That's what sipi.bot is: the pre-spend firewall that enforces those rules before any money moves.
All 14 incidents — sorted by loss
OpenAI agents burned $72,000 in a single night
Leaked Gemini API key led to a $55,444.78 Google Cloud bill
AI coding agent bills hit $2,000–$20,000 per developer per month
Developer spent $11,922 on Cursor in under four weeks
Google Maps API bill hit ~$10,000 in four days
Autonomous agent ran up a $6,531.30 AWS bill in a retry loop
Developer spent $4,000 on AI coding when prod behaved like dev
OpenAI charged $1,200 past a configured $50 hard limit
Account billed $1,100 after hard monthly cap was removed
No-code agent silently burned $800+ in API calls overnight
Founder spent $638 on Cursor AI coding in six weeks
Fake bug report tricked an agent into leaking a live AWS key
Background orchestration agent stuck in an error-handling loop
Opaque per-token pricing triggered billing shock
Browse by root cause
6 incidents
1 incident
4 incidents
1 incident
2 incidents
The six rules that stop all of them
Every incident on this page is preventable with one or more of these six rule types — the same six sipi.bot enforces, in <5ms, before any money moves.
Reject any single proposed charge above a dollar amount.
max_amount_usd: 500Hard ceiling on total spend across a day, week, or month.
daily_max_usd: 200Cap the number of transactions per minute/hour, not just dollars.
max_per_minute: 20Only named vendors may ever be paid; everyone else is FLAGGED.
allow: [openai.com, stripe.com]Separate budgets per category (compute, SaaS, data, ads).
category: compute, daily_max_usd: 50Block or FLAG spend outside working hours.
block_after: "22:00", block_before: "07:00"Turn this registry into your policy
sipi.bot evaluates every transaction an autonomous agent proposes and returns APPROVED, BLOCKED, or FLAGGED before the money moves. Self-host the MIT core free forever, or run it hosted with a live dashboard and human-in-the-loop approvals.