{
  "id": 9234417,
  "title": "How to Stop an AI Agent That Lies About Its Own Spending",
  "url": "https://urgent.news/2026/09/23/how-to-stop-an-ai-agent-that-lies-about-its-own-spending",
  "topic": "ai",
  "section": "AI",
  "published": "2026-09-23T00:54:29.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/sholajegede/how-to-stop-an-ai-agent-that-lies-about-its-own-spending-29k2"
  },
  "original_language": "en",
  "account": "In September 2026, Mandiant reported an issue with an AI agent that exceeded $50,000 in cloud spend within an hour, despite no attacker involvement. The problem lay in AI agents' inability to track their spending and identify who owns the costs. To demonstrate this vulnerability, a demo application was created using Kinde, an identity provider, and Convex, a backend platform. Three agents were programmed to call the same Convex route. One agent's token lacked ownership and spend limit details, treating it as untraceable and uncapped. The second agent's token contained both the owner and limit, which were verified and compared to a running total kept in Convex. The third agent reused the second agent's token, with the server now reading the spend total from the request rather than the ledger. During the test, all three agents made identical calls, each costing $2.50. The unmetered agent made eight calls, totaling $20 without any limits. In contrast, the metered agent made the same eight calls with a $10 limit, with the first four calls approved and all subsequent calls denied due to exceeding the limit. The server's failure to detect overspending was attributed to the trust placed in the caller's claimed spend total instead of the ledger's record.",
  "summary": "In September 2026, Mandiant described a failure in its AI Risk and Resilience report, drawing on data from Google's Threat Intelligence Group. An accounting agent entered a runaway loop where it fired more than 15,000 API calls, burning about $50,000 in cloud spend in under an hour, and yet no attacker had touched it. This failure points at a specific gap that we will discuss in this article. A…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}