Agentic AI
AI Agents Rack Up Massive Cloud Bills While AWS Billing Alerts Lag by a Full Day
Autonomous AI agents with cloud access are burning through thousands of dollars in minutes, exposing a critical timing gap between spending and detection that existing safeguards were never designed to catch.
InfoQ
A three-person startup discovered a $14,000 AWS charge after attackers extracted static credentials from an EC2 instance and used them to repeatedly invoke Claude models on Amazon Bedrock. The incident is one of several documented cases where autonomous agents—and compromised agent credentials—have generated five-figure bills before anyone noticed.
This reveals a structural mismatch: cloud billing alerts lag approximately 24 hours behind actual spending, while AI model APIs can burn through thousands of dollars in minutes.
The Speed Gap Between Spending and Alerts#
In the three-person agency case, the application was designed to use cheaper Haiku models with an expected bill under $100. Two AWS defaults compounded the damage. The credentials carried full Bedrock access (rather than restricted model access), and AWS had removed the model-access toggle in 2025, leaving all models enabled by default. By the time the team's credit card flagged the charge, the damage was done.
The most detailed incident involved a hobbyist network engineer who gave an autonomous agent full AWS access to scan a small BGP hobbyist network called DN42. The agent provisioned five 48-vCPU instances with redundant load balancers and Lambda functions—infrastructure designed to scan "at 20 Gbps with redundancy and fail-over capacity"—then reapplied the entire CloudFormation template repeatedly, duplicating the stack. The operator noticed a day later when facing a $6,531.30 charge (later negotiated to $1,894). Community estimates suggested the actual workload needed only a $5-per-month VPS.
In both cases, detection came from a credit card alert, not from AWS. Cost Explorer billing data lags up to 24 hours, so AWS Budgets and budget alerts fire against stale data—after the money is already spent.
Why GenAI Credentials Are a Unique Risk#
The threat model differs sharply from traditional cloud compromises. Attackers using stolen keys for cryptocurrency mining must provision instances, hide their activity, and convert compute to cash over days. With Bedrock access, stolen credentials instantly generate resellable model invocations at API speed, with no infrastructure for the attacker to operate and no delay between theft and profit.
Igor Zhdanko, a solutions architect at Regula, highlighted this shift: "With GenAI APIs, stolen credentials can turn into thousands of dollars in usage almost instantly."
