Platform cap failed to enforce
A spend limit was set but not honored by the provider, so the agent kept spending past it. The fix is an independent, deterministic pre-spend check outside the provider's billing.
How to stop it
Configure independent per-tx cap in sipi.bot. Every transaction matching this pattern is then BLOCKed or FLAGged before any money moves.
Per-transaction cap
A single runaway purchase, a fat-finger API call, or an attacker testing how much they can move at once.
max_amount_usd: 500Merchant allowlist
Prompt-injected purchases at unknown or malicious merchants.
allow: [openai.com, stripe.com]2 documented caps that didn't enforce incidents
| Incident | Loss | Provider | Year | Source |
|---|---|---|---|---|
| OpenAI charged $1,200 past a configured $50 hard limit | $1,200 | OpenAI | 2025 | OpenAI Community ↗ |
| Account billed $1,100 after hard monthly cap was removed | $1,100 | OpenAI | 2025 | LinkedIn (affected user) ↗ |
Close this gap in your agents
One rule covers every incident on this page. Set it once in sipi.bot and every matching transaction is evaluated in <5ms, before the money moves.