An AI feature is a second meter on your cloud bill — faster than the first, and the one almost nobody puts a hard stop on. This estimates your worst-case exposure from the three ways it runs away — a leaked key, a runaway agent, an abusable endpoint — and shows the one control that closes each. OWASP calls it LLM10: Unbounded Consumption.
🔒 Nothing you type leaves your browser — no server, no signup, no logging. Order-of-magnitude estimate, not a quote.
Worst-case exposure before you'd notice
$0
Each scenario's exposure = burst burn-rate × time-to-detection, clamped by any hard cap. Burst burn-rate = your tier's tokens/min ceiling × the output-token price (worst case: an attacker or loop maxes your most expensive tokens). Time-to-detection = your alert latency if you have a real-time alert, otherwise ~30 days (you find out on the invoice). A hard cap clamps every figure to the cap — the meter physically stops. A scenario only counts if its attack surface is present and its guard is absent (auth removes the endpoint case; a step cap removes the agent case; per-key budgets remove the leaked-key case). The range shown reflects that an attacker may not sustain full throughput. This is an order-of-magnitude estimate for prioritization — not a quote. Prices are representative list prices as of 2026-07-12; edit them to match your bill.
Drop your email and I'll send the free "10 ways your AI bill gets hijacked" one-pager — each vector with the control that stops it. Reply with what you're running and I'll tell you where it's still fail-open, within a business day.
Read by me, never shared.
Toggle "a hard spend cap that stops" and watch the exposure collapse. That's the whole lesson: the dangerous variable isn't the token price — it's how long the meter runs before anyone notices. A leaked key or a looping agent bills at machine speed; whether that costs you $200 or $200,000 is decided by your time-to-detection and whether anything actually stops the spend. See the 10 hijack routes and their controls, and the egress calculator for the other runaway line on your bill.