For builders · How this site is maintained · The guardrails
How we cap what an AI agent can spend.
Since 21 September 2026 an AI agent, Claude Code, has run this website on a schedule, and since 4 October AI agents have been buying the site's ads as well. Nobody approves what it does before it happens, so nobody is there to stop a bill either. Every cap described here sits somewhere the agent can ask but cannot edit. This page says where each one is held, how large it is, and what got through, from the site's own records.
- Paid research, all runs
- $0.09
- Ad budget a day
- $55
- Ads spent today
- $40.38
- Ads this month
- $366.15
Research is read from the run ledger, whose latest run finished . Advertising is the platforms' own figures, as read ; they are refreshed every hour.
The one rule: a limit the model reads is a request
Anything written into an agent's instructions is something it weighs against everything else it has been told. That is fine for style and bad for money. So none of the caps below is enforced by the agent. Each is a counter or a meter held by something else, which refuses, pauses or stops the run when it is reached. The agent's instructions do mention the caps, and say that every limit is a ceiling and not a target; that line changes how it spends, not how much it can.
Where the money goes
| What spends | The cap | Held by |
|---|---|---|
| The agent's paid research (a web-scraping service) | $5 a calendar day, across every run that day. | The script that starts each run, which reads the service's own meter. |
| Ads on LinkedIn, Google, Reddit and X | $55 a day for all four together, and $1,700 a calendar month. | Five small services on the server, one per platform and one for the total, under an account the agent cannot read. |
| The demonstration's AI models, which write each section for each visitor | 400 completions per visiting network a day; 20,000 for the whole site. | Counters in the site's own code, checked before each call. |
| The demonstration's profile search, $0.036 a name | 8 per network a day; 100 for the whole site, $3.60. | The same counters. |
| The demonstration's song, about $0.08 each | 6 per network a day; 40 for the whole site, $3.20. | The same counters. |
| The agent's own running time | Two hours to build, three hours in all, per run. | The scheduler, which ends the run. |
A network here is the block an address belongs to (the first three parts of an IPv4 address, the first three groups of an IPv6 one), so a household or an office shares one allowance. Each day is a UTC day. A counter holds a number under the name of its block and day, nothing else, and old ones are swept after two days.
1. Research: a meter it cannot read past
The agent may use a paid scraping service to research what people search for and what already ranks. The cap is not in the service's account settings and not in the agent's instructions. The script that starts a run reads the service's usage meter before the run, keeps the day's opening reading, reads it again while the run works and after it ends, and stops the run if the day's spending passes $5. If the meter cannot be read, or the day is already spent, the run starts without the key at all.
Free tools come first: the agent searches and fetches pages without the service, and keeps the paid one for what those cannot do. Across the 146 runs whose cost was recorded it has spent $0.09 on it in all, beside 4,766 model calls and 1,592 minutes of running time, which the scheduler counts, not the agent.
2. Ads: budgets it can only ask
The ads go through one small service per platform. Each holds the sign-in and its own limits; the agent can ask it to place an ad, pause one, or report the results, and its refusals are final. A fifth service holds the total: one budget a day for all four platforms, divided between them, and a monthly stop. When the four together reach the day's budget they all pause until the next day (UTC); at the monthly stop, until a person lifts it. A short list of words is refused in any ad, and the services cannot touch the studio's other campaigns in the same accounts.
Since 5 October a second agent, the ads desk, makes every live decision about the ads and divides the day's money; the agent that maintains the site builds the pages and pictures the ads need. Neither can raise the total. Both are told the same thing about it: the lowest price for a visitor who stays, money left unspent is not a loss, and nothing is raised without the figures to justify it.
Today's division, in US dollars, as read : LinkedIn $31, Google $0, Reddit $10, X $14. Each platform's figures are on the main report.
3. A platform's daily budget is not a wall
The surprise on the first day of ads was that the platforms do not treat a daily budget as a limit. On 4 October, LinkedIn spent $18.00 in Pakistan against a $15 budget, a fifth over, before it stopped. The service then read LinkedIn's "completed" status as a person pausing the campaign and raised a false alarm; it was fixed that evening, and the extra came off a later day's allowance.
The platforms say so in their own help pages (both read on 7 October 2026). Google: "On a given day, your campaign might spend up to twice your average daily budget", and over a month no more than 30.4 times it (About overdelivery and your average daily budget). LinkedIn: "Actual daily spend might be up to 100% higher than the daily budget amount on a given day" (Campaign and ad set budgets).
So the platform's budget is a target, and the cap you hold has to sit below what you can afford by the platform's slack: a total that pauses everything when it is reached, a monthly stop of your own, and an allowance that takes an overshoot off the next day.
4. Every visitor can spend your money
An agent is not the only thing that can run up a bill. The demonstration calls AI models to write each section for the reader in front of it, searches for a name the reader gives it, and can write a song. Each of those costs money per request, and before 21 September each was open to anyone, without a limit.
The site holds three layers, because each fails in a different direction:
- Remove the unbounded input. Two test switches let a request supply its own readings or its own name. On the live site they are off. This is the only layer that makes an attack impossible rather than expensive.
- Ration per network. A fixed allowance per address block and day, taken just before spending, never for an answer served from the cache. It stops one client and does nothing about many.
- One ceiling for the whole site. A single counter a day for each paid path, the only layer that holds when the requests come from everywhere at once.
What makes it safe to be strict: every paid path has a written answer for when the money runs out. A section the model cannot write ships its composed fallback text, the search draws no faces, the song is declined. The bill is capped, the page is not.
What got through
- Readings nobody had seen before (21 September). The device section's prompt names the reader's graphics chip, so every new chip name is a new prompt and a fresh, paid completion. Three requests carrying made-up chip names produced ten new completions. That is the cheapest attack to automate, because it looks like ordinary traffic. The answer took all three layers: the test switch that let a link supply its own readings is off outside development, and a browser that sends made-up readings itself is held by the per-network and site-wide counters.
- A ceiling counted in the wrong unit (26 September). The site-wide ceiling was 20,000 completions a day, sized for cheap model calls, and the search and the song only checked it. On a $0.036 search that ceiling allowed about $720 a day. Each paid path now has its own daily ceiling sized in money: together, under $7 a day at worst. A cap has to be counted in what costs, not in what is easy to count.
- The platform's slack (4 October). LinkedIn's $18 against $15, above.
- A platform that changes what the money buys (open). The Google Ads account this site shares with the studio's other businesses lets Google apply its own recommendations, including new keywords and new ad text, in every campaign. A budget cap does not cover that. Switching it off affects the other businesses too, so it is a person's decision, and on 7 October it was still waiting.
If you build one
- Hold every cap outside the model: a counter or a meter in something the agent can call but not edit.
- Withhold the key when the meter is silent. A run that cannot be measured does not get to spend.
- Cap the total, not only each part, and keep a monthly stop of your own beside the daily one.
- Leave room for the platform's slack. A daily budget can be overspent by half again or double, by the platforms' own rules.
- Count in money. A ceiling in calls or requests is only as good as the price of the dearest one it covers.
- Give every paid call a free answer for when the money runs out, so the cap can be strict.
- Make unspent money a normal outcome, in the instructions and in how results are judged, or the agent will read every limit as a target.
Why we publish this
Snitch is built by AlphaVenture, which builds AI systems for other companies. The second question we hear, after whether an agent can be trusted with something live, is what stops it spending. This is our answer from a site where it is running. The guardrails page covers the rest of what stands in for a person approving each change, and the main report has the rules, the ad figures and every run.