June 12, 2026
Every Agent Key Is a Naked Call
This post is part of my Medium blog.
In May, an AI agent tried to join DN42 — a hobbyist network where engineers practice BGP and DNS routing for fun. To "index" the network, it autonomously provisioned five AWS m8g.12xlarge instances — 48 vCPUs each, 20 Gbps bandwidth each — and started scanning at 100 Gbps. The operator's AWS bill hit $6,531.30 before anyone noticed. Lan Tian documented the whole incident in real time, including the part where the operator asked the DN42 community to cover the bill in Ethereum.
The agent didn't malfunction. It didn't hallucinate. It was told to scan a network, determined that required significant compute, provisioned that compute using the credentials it had been given, and ran the scan. The bill arrived.
That's not a bug. That's the system working exactly as designed. The design is the problem.
No spend limit. No scoped role. Just credentials, a task, and a $6,531 bill. (Image Assist by Anthropic)
You're writing naked calls on your own bank account
In options trading, a naked call is a position where you've sold someone the right to buy a stock from you at a fixed price — but you don't own the stock. If the price stays flat, you keep the premium. If the price spikes, you have to buy at market and deliver at strike. If the stock goes to the moon, your losses are theoretically unlimited. There's no floor. There's no cap. You just keep paying.
The responsible alternative is a covered call: you own the stock, so if it spikes you deliver what you have. Your loss is capped. Or a spread: sell a call at one strike, buy one at a higher strike, hard ceiling on your maximum loss. Either way, you define the worst case before you enter the trade.
Every API key you hand to an agent without a spend limit is a naked call written on your own bank account. The agent can spend until something external stops it. The DN42 agent spent $6,531 because it had credentials, a task, and no concept of "enough." The next one might spend $65,000. The one after that, $650,000. The loss profile is identical to an uncovered short: theoretically unlimited, stopped only by someone noticing.
The premium you collect is convenience. The potential loss is everything.
What a covered position looks like
Every agent you run needs:
- Spend limits. Every API key, every cloud credential, every service token: daily and monthly cap. AWS supports this natively; you have no excuse not to set it. If a service doesn't support spend limits at all, treat the key as a loaded weapon.
- Scoped credentials. The agent doesn't need your full AWS account. It needs a role that can do the specific thing it needs to do, in the specific region it needs to do it, and that role should expire when the task ends.
- A separate identity. The agent shouldn't be you. When something goes wrong — and something will — you need to know what the agent did, not what "you" did because the agent was running on your credentials.
- Time limits. The DN42 agent mentioned its API key would expire in a week. A week is an eternity for an autonomous system with a credit card.
A spend limit is a covered position. A scoped credential is a spread. These aren't nice-to-haves. They're the difference between a manageable loss and begging a mailing list for Ethereum.
This is going to get worse before it gets better
The DN42 operator was a developer who understood the technology and still didn't set limits. The people joining agent platforms now gave the agent their credentials because the setup screen told them to, and moved on. Ask them if they set a spend limit. They don't know what that means.
The Slop Codex has a name for the archetype behind this: the Daredevil of Disaster. Every model launch is a migration plan. Treats governance as an inconvenience for less visionary people. Can burn through thousands of dollars in API costs in a single day. The DN42 operator didn't invent this character — they just ran into them in the mirror. The pattern is everywhere. The bill is the only thing that eventually slows them down.
Here's the part worth sitting with: cloud providers and model providers benefit from uncapped keys. Every $6,531 incident enriches AWS. Every runaway agent pumps revenue to the model provider billing by the token. The defaults are "no limit" and "full access" because those defaults are profitable — for them. You pay the bill.
The agents are going to get more capable, more autonomous, and reach far more people. The guardrails are not going to appear on their own. AWS's default is no limit. The default is trust. Agents don't understand trust. They understand credentials and tasks.
Set limits on everything. Scope everything. Assume the agent will spend until it can't.
Because it will.
In The Slop Codex, this pattern appears as the Slow Boil — the field-guide monster for how each small concession moves the line, and how the temperature you're sitting in is never the temperature you'd choose. The counter-move is simple: step out of the water, look at what's changed, and decide whether the new normal is something you actually accepted.