Unattended / overnight session
An agent ran without supervision while the operator was asleep or away, accumulating charges for hours. The fix is a time-of-day rule and a hard daily cap.
How to stop it
Configure time-of-day + daily total in sipi.bot. Every transaction matching this pattern is then BLOCKed or FLAGged before any money moves.
Per-transaction cap
A single runaway purchase, a fat-finger API call, or an attacker testing how much they can move at once.
max_amount_usd: 500Daily / period total
A loop that's individually small but runs thousands of times overnight.
daily_max_usd: 200Category rule
A GPU splurge draining the budget meant for SaaS tools.
category: compute, daily_max_usd: 50Time-of-day rule
The 3am session nobody is watching.
block_after: "22:00", block_before: "07:00"4 documented unattended sessions incidents
| Incident | Loss | Provider | Year | Source |
|---|---|---|---|---|
| OpenAI agents burned $72,000 in a single night | $72,000 | OpenAI | 2025 | AlphaSignal ↗ |
| Opaque per-token pricing triggered billing shock | Cost not disclosed | Multiple | 2025 | r/CLine ↗ |
| Developer spent $11,922 on Cursor in under four weeks | $11,922 | Cursor | 2026 | dev.to (Jay Frey) ↗ |
| AI coding agent bills hit $2,000–$20,000 per developer per month | $2,000–$20,000/mo | Multiple | 2026 | The Register (Lindsay Clark) ↗ |
Close this gap in your agents
One rule covers every incident on this page. Set it once in sipi.bot and every matching transaction is evaluated in <5ms, before the money moves.