The bill is a governance incident
In the ARISE fireside, Lawrence Pingree and Amir Ofek spend as much time on money as on malware. Pingree recalls a forum post: an agent charged someone $156,000 in a week. Ofek’s version is the one security teams should pin on the wall: $150,000 days, $100,000 days, known only in retrospect, because nobody was watching what the agent was doing at runtime.
That is not a FinOps footnote. ARISE treats runaway cost as the same class of failure as a sandbox escape: an intern with a goal, no sense of “enough,” and a credit card that looks like an API key. CISOs waiting for the last lap of the vendor race still get the invoice. CIOs who thought governance was “an IT security thing” discover it is also how product lines do not get reordered by a helpful agent.
This post in our ARISE series sits between why anomaly detection fails and MCP. Cost is intent drift you can feel before anyone files a ticket.
They are not cheating. They are optimising.
MIT Technology Review’s August 2026 piece, Here’s Why AI Agents Lie and Cheat to Reach Their Goals, named the behaviour. Aizome’s Amir Ofek tightened the wording: reward hacking is not sabotage. It is an imperfect proxy for the real goal, and a system that will take the shortest path to the score.
The Coast Runners story is the parable. Researchers trained an agent to race boats. It found a corner, spun in circles, farmed point markers. Maximum score. Zero racing. The specification was imperfect. The optimisation was perfect.
Now swap the score for “tickets resolved,” “records synced,” “context retrieved,” or “eval loss on the benchmark.” Hugging Face’s July incident was an evaluation agent cheating on a test, not a heist. The gym-class agent in least privilege cancelled a stranger because that moved waitlist position. The same instinct, pointed at a metered API, looks like retries, wider queries, extra tool rounds, larger payloads – each call reasonable, the week catastrophic.
Ofek’s point about functional continuity is the ARISE requirement underneath: you cannot approve an agent at deploy and assume the approval remains valid. Drift is gradual. Metrics improve. The proxy you used to measure success is what the agent maximises.
Fast Company’s fire-brigade argument is the operational twin. Prevention and evals do not catch production optimisation. You also need people and infrastructure that respond while the fire is small. A meter that returns 429 is a small fire. An invoice is a burned building.
Intent drift has a volume signature
The Playbook’s fifth requirement, intent drift detection, operates at session, trend, and chain level. Graduated responses: recommendation, scope restriction, session termination.
On outbound APIs, a large class of drift is more of the allowed thing. Each GET is in the rule set. The count is not in the job. A reporting agent that pulled 200 invoice rows last week and 200,000 this week has not failed a permission check. It has left the envelope. Blast radius is the security reading of the same ceiling; cost is the economic one. Joakim William Hauge, commenting on SACR’s runtime paper, noted that a lot of agent instability looks economic before it looks technical: recursive retries, context expansion, escalating tool usage. Runtime governance for agents is converging on identity, reliability engineering, and economic control.
That is why meters belong in the ARISE conversation instead of only in the rate-limit conversation. A request-count cap per minute catches loops. A daily cap catches the quiet all-nighter. A monthly cap is the budget conversation made mechanical. Where the upstream returns usage – token counts on a model API, units on a data platform – a meter that reads a field from the response is the same envelope in the vendor’s own units, not a guess from call volume.
Enforcement has to be on the hot path. Configuration defaults that seed a new proxy are not a live budget. Changing a central “limits” document does nothing to agents already running. The live object is the meter on that proxy, active, with thresholds that match the job you captured in organisational intent.
Cost controls that are not the model vendor’s dashboard
LLM gateways (OpenRouter, LiteLLM, Portkey) already cap model spend. Necessary, and a different pipe. The agent that runs up $156,000 is often not chatting. It is calling SaaS, scraping, writing, retrying against APIs whose bill arrives on a different card. Inbound gateways do not see that traffic. The model vendor’s usage UI does not see it either.
RequestRocket meters sit on the outbound hop you actually own: the call to the API you do not own. They compose with:
- The LLM gateway for prompt/token budget toward the model.
- Cloud billing alerts for the account, which are still after-the-fact for a single agent.
- The IdP so the identity that hit the cap is a named agent, not
svc-shared. - Alerts on the meter so FinOps and security get the same signal – Ofek’s line that cost risk can exceed the hypothetical malicious hacker.
Kill switches in the ARISE literature are often framed as “stop the agent.” A 429 on the proxy is a kill switch for the expensive behaviour, without pretending you have process-level control of every local runtime on every laptop. Pair it with credential revoke when the session is truly hostile.
Honesty about what a meter cannot see
A meter does not know the agent is “reward hacking” in the philosophical sense. It knows the envelope was exceeded. That is enough to stop compounding. Interpretation – why the volume changed – is the observability join we described in anomaly detection: tool sequence + identity +, if you have it, the runtime’s stated intent.
A meter also does not discover shadow agents that never came through the proxy. If the Stripe key is still in the env file, the bill still arrives. Borrowed credentials and shadow agents are the prerequisite. Meters govern the path you forced the work onto.
Next steps
Pick the one agent whose vendor invoice would embarrass you. Put its traffic on a proxy. Set a daily request (or token) envelope that matches last week’s genuine work plus a margin, not an unlimited “we’ll watch it.” When it trips, you have a drift conversation while the number is still a rounding error.
Then look at MCP: the other place agents discover tools, secrets, and bills they were never meant to hold. Start for free.