The agent failure most likely to actually hit a small fund is not exfiltration but a looping agent burning the API quota a production workflow depends on. The security literature describes this failure with an attacker in it, so nobody budgets for the version that has no attacker at all.

The mechanism

Agents consume differently from chat. Anthropic’s own measurement of its production multi-agent research system: agents use roughly 4× the tokens of a chat interaction, and multi-agent systems roughly 15×. Token usage alone explained 80% of the performance variance on their evaluation, so the spend is where the capability comes from rather than waste. Their conclusion is the honest one: reserve multi-agent architectures for tasks whose value justifies the token cost. These are relative multipliers from a vendor describing its own system, and they license no absolute tokens-per-day figure. (One consultancy figure circulates widely, “around 10⁶ tokens per day per agentic workflow”. It carries no footnote, no exhibit and no analysis attribution, so it should never be repeated as a measurement.)

On top of that base rate, agents self-trigger tasks, spawn additional processes and coordinate with other agents, so consumption compounds rather than adding. OWASP files this as T4, Resource Overload, and ties it to the older LLM10:2025 Unbounded Consumption: the failure predates agents and the agentic part is the amplifier. T4 names four scenarios worth keeping in view: inference-time exploitation, multi-agent resource exhaustion, API quota depletion, and memory cascade failure.

The financial variant has OWASP’s own name: Denial of Wallet, exploiting the cost-per-use model of cloud AI services to impose an unsustainable bill. It sits in the Top 10 as an attacker technique, and that framing is precisely the problem for this audience. The realistic incident at a small fund is a citizen-built agent that loops on its own, with nobody attacking anything, exhausting the quota a reconciliation workflow shares. Same mechanism, no adversary, and no security budget line, because it doesn’t look like an attack.

Microsoft’s red team named that no-adversary version after a year of engagements against deployed agentic systems. Version 2.0 of its agentic failure taxonomy (April 2026) adds two categories the earlier version lacked: agent denial of service, where the agent is prevented from completing work or forced into resource-exhausting loops, and runaway delegation and coordination cascades, where in a dense agent network a single small perturbation — a bad instruction, a tool error, an ambiguous goal — triggers broad re-planning and re-delegation, producing exhaustion and DoS before human oversight can intervene. That is the mechanism paragraph for this page, and it comes from red-teaming real systems rather than from a threat model.

The number everyone quotes for this failure describes no actual incident. Microsoft’s v1.0 taxonomy contains a constructed sample scenario in which a crafted prompt makes a system call a reviewer agent 100,000 times, exhausting the token limit for that endpoint. It is an illustration in a taxonomy document and should be treated as one: the mechanism is real and the count is invented.

Some of the exposure sits outside the firm entirely. The agent cost base is hostage to a single supplier’s pricing decision or usage cap, and repricing can move it overnight. BCG makes this point about a hypothetical 2028 enterprise estate and, in the same article, silently promotes a component count into an agent count: its own arithmetic gives 6,500–9,100 agents, not the 100,000 the cost paragraph implies, and 100,000 is the technology-asset figure. The agent number should not be repeated. The translation for a 40-to-500-person fund is dozens to low hundreds of agents, and the pricing exposure is identical in kind, because it comes from the vendor’s price sheet rather than from headcount.

A governance gap sits here, and it shows how young the field is. Microsoft’s v2.0 taxonomy carries resource exhaustion as a failure mode and its mitigation families (identity, memory hardening, control-flow control, environment isolation, UX design, logging and monitoring, cross-prompt injection controls, supply chain) contain no budget, quota, rate-limit or spend-cap control of any kind. The most thorough public agentic failure taxonomy names this failure and leaves it unanswered. Every control listed below has to be sourced from OWASP or from vendor billing documentation instead.

What to do

Cap the blast radius architecturally before instrumenting anything. Give each agent, or each small group of agents, its own API key or billing scope with a hard ceiling, so a loop exhausts one budget rather than the firm’s quota. This is the one control here that works while everyone is asleep, and it is the reason to prefer separate scopes even when a shared key is simpler. See cost controls for the mechanics and the platform specifics.

Then apply the runtime layer, knowing what it is. OWASP’s T4 mitigations are quotas, adaptive scaling, real-time load monitoring, and rate limiting per agent session; its detective controls add auto-suspension above a consumption threshold, tracking cumulative consumption across multiple agents (so that a fleet cannot collectively overload something no single agent would) and limiting concurrent AI-initiated modification requests. All of these are runtime and detective controls, worth having, and distinct from the architectural cap above.

Separate the shared quota from the important workflow. If a production process and a citizen experiment draw on the same endpoint and the same rate limit, the experiment can take the process down without touching it. That is the failure to design out, and it costs nothing at design time.

Test the ceiling before an incident tests it. Almost nobody runs this exercise and it takes about twenty minutes: deliberately drive an agent into its ceiling in a non-production scope and watch whether it stops, whether anyone is told, how long the alert takes, and whether anything else broke when it did.

How you’d know it’s working

Three questions have answers for every agent: what it spent last month, who owns that spend, and what the contractual exposure is if the provider reprices. Those are the three gaps consultancies name, and each one is directly observable.

Some agent has hit its ceiling and stopped, and someone can say which one and when. A quota nobody has ever reached is an untested control.

The alert fires before the invoice arrives. Billing-side anomaly detection typically lags by up to a day, so a firm whose first signal is the invoice is relying on its finance department as the control.

What this doesn’t solve

Budgets cap the blast radius rather than correctness. A cheap agent can be confidently wrong all month inside its quota. See unreliable output.

Quota exhaustion is the denial of service in most realistic cases, so the control and the failure share a surface. A hard cap that stops a looping agent also stops a legitimate one that had a busy Tuesday, and setting the ceiling too tight moves the incident from the bill to the business process. There is no setting that avoids both, only a choice about which failure a firm would rather explain.

Nothing here addresses the value question. Cost visibility shows what an agent costs, not whether it is worth anything, and an agent comfortably under budget can still be quality debt that nobody uses. Ranking by cost per outcome needs an outcome measure, and that measure is evals rather than FinOps.

And the evidence base is thin in a specific way. The mechanism is well described by two independent taxonomies; the prevalence is described by nobody. There is no published base rate for how often citizen-built agents blow a quota, no incident corpus, and no measured distribution of agent spend at firms of this size. The controls are cheap enough that this matters less than it would elsewhere, but confident writing about this failure, including this page, should not be mistaken for measurement.

See also

• Cost controls — the direct answer: meters, ceilings, anomaly detection, and where each one fails.
• Multi-agent cascades — runaway delegation, which is where exhaustion comes from when nobody is attacking.
• Agent sprawl — unallocated spend is usually the first sprawl signal a finance function can see.
• Quality debt and orphaned apps — run cost that exceeds build cost, and the agents still drawing it after everyone stopped using them.
• AI gateways — where token quotas get enforced, and why a gateway counter is a governor rather than a ceiling.
• Runtime guardrails — the enforcement layer these limits live in.