An agent that calls a model in a loop has a failure mode a chatbot doesn't: it can decide, entirely reasonably, to try one more time — a few thousand times — and hand you a bill the size of a seed round. The fix that actually holds isn't a single setting you flip. It's three independent brakes, stacked, because any one of them can be bypassed: a provider cap on the account, a gateway budget per agent, and a hard bound on the loop itself. Here's how to add all three, cheapest first.

The one-line answer, up top#

You want all three because each fails differently. A provider cap won't save you from one agent eating the whole team's budget. A gateway budget won't help if a call skips the gateway. A loop bound won't help if the loop spawns an unbounded sub-agent. Defense in depth is the whole point.

Layer 1: the provider cap (and the trap in it)#

Start at the account. This is your last line of defense, and the two big providers behave differently — which is exactly the thing that burns people.

Anthropic gives you a real hard stop. Set a monthly spend limit in the Console (Settings → Limits); when you hit it, "API usage pauses until the next month." Every organization also sits on a tier with its own cap — Start at $500/mo, Build at $1,000/mo, Scale at $200,000/mo — and you can set your own limit below the tier cap. Separately, Anthropic meters rate limits as RPM, ITPM (input tokens/min), and OTPM (output tokens/min) using a token-bucket algorithm, returning a 429 with a retry-after header when you cross one. Useful detail for cost: cached input tokens don't count toward ITPM on most models, and max_tokens caps output length without any rate-limit penalty — so cap it aggressively.

OpenAI is the trap. As of early 2026, the dashboard's monthly budget limit behaves as a soft notification, not a hard cutoff — per OpenAI's own docs and a wave of developer reports, requests keep flowing past it. If you set a budget and walked away thinking you were safe, check again. The dependable native hard stop on OpenAI is to run the account on prepaid credits with auto-recharge turned off: when the balance hits zero, calls fail. Set your max_completion_tokens too — on reasoning models it bounds visible and reasoning tokens, which is where the hidden spend lives.

Don't trust a dashboard budget you haven't tested. Deliberately blow past a tiny limit once and watch what happens — a "limit" that only emails you is not a brake.

Layer 2: the gateway budget (the per-agent brake)#

An account cap is all-or-nothing. To stop one agent — or one customer — from spending everyone else's money, put a gateway in front of your models and give each agent its own virtual key. LiteLLM is the common open-source choice, and its key object is exactly the vocabulary you want:

curl http://localhost:4000/key/generate \
  -H "Authorization: Bearer $LITELLM_MASTER_KEY" \
  -d '{
    "key_alias": "research-agent",
    "max_budget": 50,          # USD, hard stop
    "budget_duration": "30d",  # resets monthly ("1h", "30d", ...)
    "rpm_limit": 60,           # requests/min
    "tpm_limit": 100000,       # tokens/min
    "max_parallel_requests": 5
  }'

When the key crosses max_budget, LiteLLM rejects the call with a BudgetExceededError — a hard stop, not an email. You can go finer with model_max_budget (a different cap per model, so the agent can use a cheap model freely but a frontier model sparingly) and set a soft_budget to fire a Slack alert before the wall. The same max_budget / rpm_limit fields apply to teams, internal users, and end-customers, which is how you bill and bound a multi-tenant product. If you'd rather not self-host, managed gateways (Cloudflare AI Gateway shipped dollar spend limits in June 2026; Portkey and Bifrost expose the same budget-plus-rate-limit shape) do the equivalent.

Layer 3: bound the loop itself (do this first, honestly)#

This is the cheapest brake and the one people skip. Every serious agent framework ships a hard cap on how many times the loop can go around — it's one line, and it turns "infinite spend" into "raise an exception":

If you've rolled your own loop, add the same two things: a turn counter that throws, and a running-cost tally that trips a circuit breaker (the classic Closed → Open → Half-Open pattern) once a run crosses a dollar threshold. For per-user request quotas, a Redis token bucket — the same algorithm Anthropic runs on its own API — gives you burst-tolerant limits in a few lines of Lua.

The checklist#

  1. Provider: Anthropic monthly spend limit set; OpenAI on prepaid credits with auto-recharge off (not just a dashboard budget). Cap max_tokens / max_completion_tokens.
  2. Gateway: every agent calls through LiteLLM (or equivalent) with a per-key max_budget, budget_duration, and rpm_limit. Nothing calls the provider directly.
  3. Loop: max_turns / recursion_limit set explicitly (don't inherit the default silently), plus a per-run dollar cap where the framework offers one.

None of these is sufficient alone. Together they mean the worst case isn't a five-figure surprise — it's a 429, a BudgetExceededError, or a MaxTurnsExceeded in your logs, and a bill that stops where you told it to. That's the difference between an agent you can leave running and one you have to babysit — and if you want the context on why these bills scale the way they do, we dug into why agent costs scale quadratically and what the $206B agent-spending forecast is really pricing in.