Here is a contradiction worth sitting with. Cognition's Devin Security Swarm is an AI tool built to clean up the mess AI tools made—it clears the backlog of findings that AI code generates at 10x human rate. The Cloud Security Alliance calls that backlog "a direct consequence of AI-assisted development velocity outpacing review cadence." So the cure keeps pace with the disease by running on the same engine.
That framing—cure and disease sharing an engine—is the whole story of AI code in production right now. And most operators misread it as two separate problems when it's one.
Start with the eleven days.
In November 2025, a market-research pipeline ran four LangChain agents coordinating over A2A. Two of them—an Analyzer and a Verifier—entered a loop. The Analyzer generated content. The Verifier asked for more analysis. The Analyzer obliged. Repeat.
According to the incident write-up, weekly spend climbed $127 → $891 → $6,240 → $18,400. It reportedly shut down at $47,000 after 264 hours.
Here is the part that should unsettle you: the team was watching the whole time. They had Helicone. They had Slack alerts at 50%, 80%, and 95% of budget. They had an OpenAI spending cap. According to the incident write-up, none of those tools stopped the loop.
None of them could stop the next API call.
That is not a monitoring failure. They had monitoring—three layers of it. What they didn't have was anything sitting on the execution path with the authority to refuse the next request before it went out. They could see the car leaving the road. They had no seatbelt.
That is not a monitoring failure. They had monitoring—three layers of it. They could see the car leaving the road. They had no seatbelt.
Now widen the lens, because the same shape is playing out in security queues.
AI-generated code is reportedly roughly 42% of what ships to production, and it produces security findings at 10x the rate of human-written code. Teams that once reviewed about 1,000 findings a month are now staring at 10,000-plus, most of them false positives from tools that pattern-match without reasoning about business logic.
Read those two failures side by side. A runaway bill is shipping (API calls) outrunning the human control that was supposed to gate it (alerts). A flooded security queue is shipping (AI-authored PRs) outrunning the human control that was supposed to gate it (review). Same dynamic, two masks.
This is what that bottleneck costs when it goes unpriced: 10,000 findings a month no human team was designed to clear, and enforcement tooling is the only thing that keeps it off the invoice.
So here is the turn. Both problems get sold the same solution, and the solution is architecturally incapable of fixing either.
For runaway spend, you get dashboards. Helicone, Langfuse, LangSmith, CloudWatch billing alarms, Slack budget alerts, provider caps. Every one of them shows you what happened after the call completes.
For security findings, you get static scanners that fire after the code is generated—producing exactly the noise flood we're describing, not stopping it.
Both categories share one fatal trait: they fire after the money is spent or the noise is made. They live beside the execution path, reading logs and metrics. They never sit on it.
And the providers you'd assume protect you mostly don't. Google's own documentation states that "setting a budget does not automatically cap" usage. OpenAI reportedly removed its hard spending limit in late 2025—once you exceed the soft threshold, "API requests will continue to be processed without interruption."
Two of the three major AI vendors give you a doorbell, not a deadbolt.
The invoices prove the gap. A stolen Gemini key reportedly turned a $180 month into $82,000 in 48 hours—a 455x spike. A live meter watching rate-of-change catches that in minutes. A billing alert catches it at month-end, by which point Google notes it "might take up to two days for usage charges in the project to be reported," so the number keeps climbing even after you pause the key. One Japanese team reportedly paused at roughly $44k and watched it pass $128k.
Now look at what actually works, and notice the single property it shares.
Devin Security Swarm doesn't just scan. Per Cognition, for high-confidence findings, before it opens a remediation PR, it spins up a sandboxed session and reproduces each vulnerability against a running build to confirm it's actually exploitable. Per Cognition, it hits 72% recall at $90.23 a scan—higher recall and lower cost than the next-best tool—and it uniquely caught three critical bugs every competitor missed, including a PHP sandbox bypass and a Spring Kafka deserialization flaw.
The mechanism that matters isn't the recall number. It's that validation happens before the finding reaches the human queue. Enforcement moved onto the path: nothing reaches a person until an agent has proven it real in a sandbox. The queue reflects risk, not noise.
The spend side has the exact mirror. The pipeline that went from $203 to $14 per order—a 93% cut—did it with four guards including a per-call token budget that sits on the call path.
The first guard is one parameter: max_tokens = 12,000 on every call. Per the author, without it, the model generates as many tokens as it wants. With it, no single call exceeds roughly $0.12 in output. The author's instruction is blunt: "If you ship one guard today, ship this one." It needs no Redis, no new class, no infrastructure—just a parameter on a call you're already making.
That is the difference between an alert and a guard. An alert fires after the car left the road. A guard refuses the next call before it's made. Most production AI systems have the alert. Almost none have the guard—until the invoice arrives.
Teams build the alert first because it's easy. Helicone and Langfuse integrate in an afternoon. The enforcement ring—a CostGuard class, a pre-flight budget check, a max_steps loop limit—takes thirty minutes of wiring nobody prioritizes. That thirty minutes is the entire distance between a $25 overrun caught mid-run and a $47,000 invoice discovered at month-end.
The deeper point is that agent cost isn't a finance problem you catch later. As one architect put it, reportedly a human can approve a workflow at 2 p.m. and lose control of its cost profile by 2:17. The workflow was deterministic when you approved it; the agent made it non-deterministic the moment it started deciding whether to retry, branch, or call another model. Finance catches deterministic spend. It cannot catch a decision that hasn't happened yet.
The right control surface, then, is not "who can call this API"—that's the security policy—and not "when does a human say yes"—that's the approval queue. It's a third thing: "how much can this agent spend while trying?" That question can only be answered by something on the call path, before the call. The transport layer is a good home for it, because every tool call traverses the proxy regardless of what the agent's own framework config says—reportedly a per-session cap of 500 calls, a rate limit of 30/minute, a daily token budget enforced on the request, not the receipt.
So here is the audit. Go find every AI control you've bought or built—every dashboard, every alert threshold, every provider cap, every scanner. For each one, ask a single question.
Does it block, or does it merely tell?
If it tells, it belongs in the outer ring: useful for postmortems, useless for prevention. Keep it, but stop mistaking it for a control.
If it blocks—if it can refuse the next action before it happens—it's the only category that was ever going to save you. That's the ring you're probably missing.
The $47,000 team had five things watching. They had zero things blocking. The security team drowning in 10,000 findings has the same imbalance in a different costume. The fix in both cases is the same move: stop building the ring that describes the crash, and start building the one that sits on the path and says no.