Developer Builds Open-Source Firewall After AI Agent Racked Up $2,800 Bill Overnight

A developer woke up to a $2,800 charge after their AI agent made 21 API calls to a premium LLM endpoint in just 60 seconds at 3 AM, with a budget alert email arriving only after the money was already spent. Standard defenses like rate limits and manual monitoring failed to prevent the incident, prompting the developer to build AgentShield, an open-source pre-execution spend firewall that evaluates every transaction against configurable rules before any API call is made. The tool supports seven composable rules including transaction limits, velocity checks, and category blocks, and can return an APPROVED, BLOCKED, or FLAGGED decision in under one millisecond. Recognizing that blocking runaway agents still leaves the root cause unknown, the developer collaborated with Jacopo, creator of Agent-Devtools, a local-first causal debugger that provides visual replay and full execution timelines to explain why an agent misbehaved. The two tools were integrated via a shared event schema, allowing spend decisions to appear directly within Agent-Devtools' execution timeline for a combined prevention-and-diagnosis workflow.