To stop runaway AI agent costs, you need two things working together: a hard cap that blocks spend the moment it hits your limit, and an alert that warns you well before you get there. The cap stops a surprise bill from ever happening. The alert gives you time to act while it's cheap. Get both in place and a forgotten agent loop or a leaked key can no longer drain your budget without anyone noticing.
That's the short answer. Here's why the usual defaults don't do it, and how to close the gap.
Why AI agent spend runs away in the first place
Runaway cost isn't usually one big mistake. It's a small one that runs unwatched for a long time. An agent gets stuck retrying a failing tool call and keeps hitting the model. A heavy workload resends a huge context every single turn. A key gets pasted into a shared script, or leaks, and now it's serving more traffic than you ever signed up for.
In every one of those cases the money keeps climbing quietly, because standard provider billing only shows you the total after the billing period, not a live number you can act on. By the time the invoice lands, the damage is done. Preventing surprise AI bills is really about shortening that gap between "something is wrong" and "someone finds out."
The real risk: a forgotten loop over a long weekend
Picture an agent kicked off on a Friday afternoon that hits a loop no one noticed. It runs all weekend, burning tokens on retries against a model that costs real money per call. Nobody's watching a dashboard on Saturday. On Monday you find a bill that's several times what a normal week costs.
Or picture a key that leaked into a public repo. It's not your team spending anymore. It's whoever found the key, running their own workload on your account until you spot it. Both scenarios share one root cause: nothing was standing between the spend and your budget. There was no wall to hit and no bell to ring.
It happens to well-run companies too
This isn't a small-team problem. Two of the most sophisticated engineering organizations in the world got caught by exactly this pattern in 2026.
Uber gave Claude Code to around 5,000 engineers and, according to Fortune, "used its entire annual budget for the software in four months." Cost per engineer reached $500 to $2,000 a month. The response was blunt usage caps, added after the spend had already happened.
At Meta, staff raced an internal usage leaderboard. The Information reported employees burned 73.7 trillion tokens in 30 days, and the company moved to cap employee AI usage. Again, the caps came after the number was already enormous.
The common thread: no hard caps and no live tracking in place before the spend spiked. The tools were productive. The controls were missing. If you want the fuller picture of what that productivity-versus-invoice tension looks like, we wrote about it in what happens when your team gets 3x faster with AI coding tools.
How Clawgate stops it before it starts
We built Clawgate because no single existing tool did all three of the things a team actually needs to keep AI spend under control. Monitoring tools show you the number but can't stop it. Budget dashboards alert you but let the spend continue. Nothing on the market watched for abuse. So we built a control layer that does all three in one place. This started as an internal tool at Virstack that cut our own AI bill by 70% before it became a product, so we know the failure mode firsthand.
Clawgate sits between your team and the model. Developers point Claude Code or Codex at the gateway with one vsk_… key. Every request is authenticated, checked against your budgets, tied to a user and a project, then forwarded. Here's how each part of that closes a hole a runaway agent would otherwise fall through.
1. Hard caps that block, not alerts that arrive late
Budgets in Clawgate are hard stops. You set a daily or weekly cap in dollars, tokens, or sessions, per user and per project. When the limit is hit, the request is blocked. It returns a 403, not a 429, on purpose: coding agents silently retry a 429, so the developer would never see it, while a 403 surfaces the actual limit message. Project budgets are an all-time spend cap checked before user quotas, so a forgotten weekend loop hits a wall instead of an open tab. This is the piece that guarantees you never get a surprise bill, because spend physically cannot exceed the number you set.
2. Alerts before the wall
A hard stop that fires with no warning would just move the surprise from the invoice to the middle of someone's work. So Clawgate also sends a configurable alert by email when spend crosses a threshold you set, 80% by default. That's your window to top up, switch to a cheaper model, or pause, all before the cap ever engages. You get the early warning and the hard stop.
3. Abuse and impersonation detection, so a leaked key can't drain you
This is the part most cost tools skip entirely, and it's exactly what catches a leaked or shared key. Clawgate runs content-fingerprint abuse detection: it flags keys that look leaked or shared, and impersonation, where a request's content doesn't match the project it claims to belong to. Pair that with hard caps and the blast radius of a leaked key is capped by design. Even if a key gets out, it can only ever spend up to its budget before it's blocked, and the detection flags it so you can rotate it.
Those three together, control, abuse detection, and one more lever below, are what we mean by doing all three. The AI providers won't build this, because tokens are their revenue. They offer prompt caching, but nothing that actively compresses your context or routes work to a cheaper model.
Shrink the blast radius with token compression
The best way to survive a runaway loop is for each wasted call to cost less. Clawgate's opt-in prompt compression cuts up to 92% of the tokens agents resend each turn on heavy workloads, while accuracy holds. Old repeated context is compressed; the recent turns, system prompt, tools, and thinking blocks are left untouched, and the savings show up in dollars on the dashboard. Fewer tokens per turn means a loop that does slip through burns far less before it hits the cap. You can read more in our write-up on how we cut our own AI bill by 70%.
A simple setup that closes every gap
Putting this in place takes minutes, not a migration. Point Claude Code or Codex at the gateway with one key, no local config juggling and no separate provider keys. Then set the three controls:
- Set a hard cap per user and per project. Daily or weekly, in dollars or tokens. This is your surprise-bill insurance.
- Set the alert threshold. 80% is the default; lower it if you want more runway to react.
- Leave abuse detection on. It watches for the leaked-key and impersonation patterns without any tuning from you.
From there, spend is visible live and historical, attributed to the right person and project automatically, so you're never guessing who ran what. If you want to go deeper on any one piece, see how to set a Claude Code budget, how to track Claude Code usage per developer, and our broader guide to AI spend control.
Because AI is billed at provider cost plus one clear platform fee, and because the budgets are hard stops, there's no line item you didn't expect. Free to start, and Enterprise can self-host in their own infrastructure with no per-token markup.
Frequently asked questions
What causes runaway AI agent costs?
Usually one of three things: an agent stuck in a retry or tool loop that keeps calling the model, a heavy workload that resends a big context every turn, or a key that leaked or got shared and is now being used by more people (or more agents) than you expected. In each case spend keeps climbing with no one watching, because the default billing only tells you the total after the fact. The fix is a hard cap that blocks at the limit plus an alert that warns you before you get there.
Can I set a hard limit that cannot be crossed?
Yes. Clawgate budgets are hard stops, not alerts. You set a daily or weekly cap in dollars, tokens, or sessions, per user and per project, and when the limit is hit the request is blocked. It returns a 403 so the developer sees the limit message instead of a 429 that coding agents silently retry. Project budgets are an all-time spend cap checked before user quotas, so a runaway agent hits a wall rather than an open tab.
How do I catch a leaked or shared API key?
Clawgate runs content-fingerprint abuse detection. It flags keys that look leaked or shared and impersonation, where a request's content doesn't match the project it claims. Combined with hard caps, a leaked key can only ever spend up to its budget before it's blocked, so the blast radius is capped even if a key gets out.
Will I be warned before the limit is hit?
Yes. Clawgate sends a configurable alert by email when spend crosses a threshold you set, 80% by default. That gives you time to top up, switch to a cheaper model, or pause before the hard cap stops work. You get the early warning and the hard stop, so a spend spike never turns into a surprise bill.
Written by Chathuranga K, an engineer at Virstack.
Cap your AI spend before it caps you
Set hard budgets per developer and per project, get an alert at 80%, and let abuse detection watch for leaked keys. A forgotten loop hits a wall, not your invoice.