The $12,000 Infinite Loop: An AI Agent With No Stop Button

A developer built an autonomous agent to run recursively in a sandbox. It had no real exit condition. It kept calling the API, on its own, until the bill hit $12,000 — a forensic case study in what happens when "the agent decides when it's done" is the only stop condition an autonomous system has.

What Happened

Documented in detail as "The $12,000 Infinite Loop: How My AI Agent Bankrupted a Sandbox," this is a first-person account of exactly the failure mode Thuban Cost Guard exists to catch. An autonomous agent was set up to recurse — call itself, process the result, call itself again — without a hard-coded ceiling on how many times that could happen. The agent's own judgement was the only thing standing between "keep going" and "stop." It didn't stop. Each recursive call was another billed API request, compounding for hours before anyone caught it, by which point the sandbox environment had run up a $12,000 tab.

This is a smaller-scale, single-developer version of the same failure that burned $47,000 across a 4-agent LangChain system in a separate incident (see our earlier post on that one) — different framework, different scale, identical root cause.

The Common Thread: No Stop Button

What makes this pattern so dangerous isn't sophistication — it's how ordinary the code looks:

• Recursive or looped agent logic that calls an LLM API is, structurally, no different from any other loop — except every iteration has a real dollar cost attached.
• Developers writing agent code reach for "keep going until the task feels done" far more often than "stop after N calls, no matter what," because the former reads as smarter and the latter feels like admitting the agent might fail.
• Sandboxes give a false sense of safety. A sandbox limits what an agent can touch on disk or in production — it does nothing to limit what an agent can spend on API calls.
• By the time a human notices something's wrong (a spinning cursor, a stuck process, a strangely long-running test), the financial damage is usually already done. Detection-after-the-fact doesn't undo a bill.

// recursive agent loop, no depth limit, no budget guard
async function runAgent(context) {
  const result = await llm.chat.completions.create({
    model: 'gpt-4',
    messages: buildPrompt(context),
  });
  if (!isTaskComplete(result)) {
    return runAgent(updateContext(context, result)); // recurses indefinitely
  }
  return result;
}

How Thuban Cost Guard Catches This

TCG-101 (Unbounded AI Loop Execution) doesn't care whether the unbounded pattern is a while loop or a self-recursive function — the underlying risk is the same: an AI SDK call with no reachable, bounded exit condition. Cost Guard's static analyzer checks for a genuine iteration cap, budget-guard wrapper, or guarded break before a loop is cleared. If the only thing standing between "call the API" and "stop calling the API" is the model's own output, that's flagged CRITICAL — and if the call inside also has no output token limit set, TCG-201 escalates the combined finding to HIGH.

Sources

• Towards AI: The $12,000 Infinite Loop — How My AI Agent Bankrupted a Sandbox

npx thuban protect