The dashboard the on-call person opens has a per-seat number in it, because AI sessions get budgeted the way SaaS seats were, at a flat per-seat or per-token rate tracked as an average [11]. Revenium's own 90-day sample puts the median code-implementation task at $2.24 [7]. The stray four-day session cost $3,762 [3], roughly 1,680 times that median [2], about 78 cents across each of its 4,819 calls [1]. A mean built from tasks like the first cannot describe an outlier like the second.
The shape of the spend is the mechanism. Of 14,680 runs tracked over 90 days, the top 1% carried 46% of the total and the bottom 90% carried 12% [8]. One percent of 14,680 is about 147 runs [3]. An alarm set on the total, or on the average, is watching the roughly 13,200 runs that were never going to hurt anyone.
The expensive half is also the half nobody reviews. Across 10,005 interactive agentic sessions the bill came to $109,118, while 4,171 automated pipeline tasks came to $6,723 [9], which works out to $10.91 per interactive session against $1.61 per automated task [4], close to seven to one [5]. The pipeline that opens and reviews pull requests goes through change control. The engineer with a chat window open at four in the afternoon does not.
The destruction cases fail for the same reason one layer down. In the nine incidents in the study ZDNet cites, the agents held valid credentials and did not trip standard monitoring until the damage was already visible [1]. A credential cannot tell whether the caller means to run a migration or drop the table. And the recovery path belongs to someone else: across the 109,000-plus incidents analyzed, median resolution time has been roughly flat since 2023, and the most common fix is waiting for another company's engineers [2]. Worth noting who is holding the notebook here. Revenium sells AI spend management and audited its own practices, which is a vendor with an interest in your alarm. Still, the finding that its own developer's laptop billed $3,762 with nothing budgeted is not the kind of thing a vendor volunteers lightly [12].
The 2x2 for Monday. One axis: can this agent change state you cannot restore inside an hour. Other axis: does it have a hard ceiling that only a human can raise. Reversible and capped, let it run unattended. Capped but irreversible, review per action rather than per session, because the ceiling limits the bill and not the blast radius. Reversible and uncapped is where the 11-day loop lived, about $4,273 a day [4][6], and Revenium's line on that class of failure is that each action was rational in isolation but the cumulative cost was not [6]. The fourth box, irreversible and uncapped, is the one the nine wipes were launched from, at least on the reach side [1].
So cap by run instead of by seat, and make the cap refuse the call rather than send mail. The tradeoff is a developer sitting idle while somebody raises a ceiling mid-task, which will happen and will be annoying; set against a mid-level agentic assistant that BakedWith prices at $100 to $500 a month [10], one four-day accident already costs more than seven months at the top of that band [7].
