Rate Limiting Will Not Save You From a Runaway AI Agent

TL;DR. The scary AI bill is rarely an attacker. It is your own agent stuck in a loop overnight, or one tenant whose usage quietly spikes a hundredfold. A rate limiter cannot see either, because it counts requests per minute per route, and the damage here happens inside a single request or across a slow-moving window per customer. This post explains the two failure modes a rate limiter misses, and shows a Laravel circuit breaker that watches the actual AI traffic and trips before the budget is gone. It observes by default, so it cannot break a real workload on day one. Free and open source.

The 3 a.m. invoice

The pattern shows up again and again in developer postmortems: an agent hits a transient error, retries, appends the failure to its context, retries again, and the loop never terminates. Each retry is a full provider call, context grows, tokens compound, and by morning the run has made tens of thousands of calls. Teams on the OpenAI forum describe exactly this, agents looping unattended and running up four- and five-figure charges before anyone is awake to notice (How are you handling runaway agent costs?).

Agents do not spend like chatbots. A chatbot sends one message and gets one answer. An agent runs a reasoning loop with tool calls, reads, edits, and re-checks, so a single user action can fan out into hundreds of model calls. That is the unit of damage, and it is invisible to the tool most teams reach for first.

Why a rate limiter does not catch it

Laravel's rate limiter is excellent at what it does: cap requests per minute per key, usually per route or per IP. That shape does not match either runaway mode.

The loop happens inside one HTTP request. Your route fired once, so the per-route limiter sees one request and is satisfied. The 800 model calls that route made internally are below its line of sight entirely.
The spend anomaly happens per principal, over time. One tenant going from a normal daily volume to a hundred times that does not trip a per-minute limit if each individual minute looks plausible. The limiter has no notion of "normal for this customer" and no memory across the window where the anomaly actually shows.

Rate limiting models politeness at the front door. Runaway cost is a fire in a back room. Different sensor.

Two brakes, on the traffic that matters

laravel-ai-circuit-breaker registers a global HTTP-client middleware, so it governs every outbound call to a known AI provider regardless of the SDK. Prism and the Http facade are covered automatically; a client with its own Guzzle stack attaches CircuitBreaker::stack().

composer require laravelsecurityaudit/laravel-ai-circuit-breaker

It does two things a rate limiter and a cost dashboard do not.

1. The loop breaker

Within one request lifecycle it counts AI calls and detects repetition: too many calls, or the same call repeated too many times. A self-recursing agent trips this first, inside the request that spawned it, before the loop has a chance to run all night.

2. The spend-anomaly circuit breaker

Per principal, over a rolling window, it tracks estimated input tokens and call volume. When a principal spikes past your threshold it opens a circuit with a cooldown, so the next calls from that principal fail fast instead of feeding the fire.

A "principal" is the authenticated user, tenant-aware when your user model exposes a tenant key, falling back to the client IP. You can bind your own PrincipalResolver to define the fingerprint that matters for your app.

Observe first, enforce when you trust it

This is the part that makes it safe to install on a live app. By default the breaker only observes: it counts, fires events, and logs, but never blocks. It cannot break a legitimate workload on a false anomaly, because on day one it is not blocking anything. You watch the events, tune the thresholds to your real traffic, and only then turn on enforcement:

CIRCUIT_BREAKER_ENFORCE=true

When enforcing, a tripped limit opens the circuit for that principal and throws CircuitOpenException, which fails the AI call closed. fail_open is true, so an internal error in the breaker itself never breaks a real call.

CIRCUIT_BREAKER_ENABLED=true
CIRCUIT_BREAKER_ENFORCE=false
CIRCUIT_BREAKER_MAX_CALLS=25
CIRCUIT_BREAKER_MAX_REPEATS=5
CIRCUIT_BREAKER_WINDOW=60
CIRCUIT_BREAKER_MAX_TOKENS=200000
CIRCUIT_BREAKER_COOLDOWN=300

Wire the alarms in one listener

LoopDetected and CircuitOpened fire in both observe and enforce mode, so you can send them to Slack, PagerDuty, or your SIEM with a single listener and get paged the first time an agent misbehaves, long before you have decided to start blocking.

Event::listen(LoopDetected::class, function ($event) {
    // notify your on-call channel
});

An honest note on the numbers

The outbound request does not carry token usage, so spend is estimated from the request body, roughly four characters per token. This is an anomaly brake, not a billing system. It is tuned to catch the shape of a runaway, an order-of-magnitude jump, not to reconcile your invoice to the cent. Exact post-hoc accounting from the response is a planned addition. Treat it as the smoke detector, not the accountant.

Anatomy of a runaway loop

It helps to see the shape the loop breaker watches for. A typical agentic run does something like this inside a single request:

The agent calls the model to plan a step.
It runs a tool, and the tool errors.
It feeds the error back to the model and asks it to try again.
The model proposes a near-identical step.
Back to step two.

Nothing here is a bug in any one call. Each request is well-formed and each response is reasonable. The failure is emergent: the same call repeating with a slowly growing context. A per-route rate limiter sees one inbound request and waves it through. The loop breaker, counting calls and repeats within that request, sees the fifth near-identical call and trips. The difference is where the sensor sits, the front door versus the actual provider traffic.

Multi-tenancy makes the spend brake matter just as much. In a shared app, one tenant's misbehaving integration should not drain the budget for everyone. Because accounting is per principal, an anomaly is contained to the principal that caused it: the cooldown opens the circuit for that customer alone while everyone else keeps working.

laravel-ai-circuit-breaker is MIT licensed and part of a family of Laravel AI-security packages: ai-lint for exposed keys in source, the egress guard for secrets and PII leaving in prompts, and a processing ledger for GDPR records. The breaker is the one that protects the budget.

This is defensive tooling, not financial or legal advice, and not affiliated with or endorsed by Laravel, Laravel LLC, or any AI provider.