A developer on Reddit posted a screenshot of a $700 bill from one overnight run. The agent had built itself a retry loop. It didn't crash. It didn't time out. It kept asking the same model the same question until someone woke up and noticed.
That is what most LLM cost incidents look like. Not a slow climb across thousands of users. One run that never ends.
A loop rule watches one run
Loop rules live on the Runaway loops tab of the Firewall page. Each one watches a single trace, meaning one agent run, from its first model call to its last. The next run starts a fresh watch with counters back at zero.
A conversation is not a run. If you want to cap a whole conversation, that's a regular firewall rule grouped by session_id, not a loop rule. Sessions and traces draws the line.
The two detectors
Exact prompt repeat catches a run that keeps sending the same prompt, or a short back-and-forth that keeps repeating. You get three settings: window size (how many of the run's recent model calls to consider, default 20), max cycle length (default 3), and repeats per cycle length. On the defaults it fires when the same prompt goes out three times in a row, or a two-step cycle repeats twice.
Per-trace hard cap is a ceiling on one run, in calls, USD, or tokens. The templates come pre-filled at 25 calls, $5.00, and 200,000 tokens.
Loops come in other shapes too. An agent that paraphrases itself instead of repeating word for word. A plan → tool → plan cycle where no single step ever repeats. Context that grows every iteration until one call costs more than the first ten together. We don't pattern-match those. The cap catches them anyway, because it doesn't care why a run got expensive.
Notify, or stop the run
Every loop rule is either Notify only or Block. Notify lets the run finish and sends you an alert plus an inbox row. Block stops a later call on that run, and your app gets a TokenPoliceBlockedError.
Blocking is deliberately imprecise, and the product says so on every loop template: "The trigger is approximate — the call that crosses is allowed; we stop a later call on the same trace. Fast back-to-back calls can slip past." Treat a $5 per-trace cap as a ceiling on runaway cost, not an exact counter. You will pay slightly more than $5.
You already have three
Every new workspace is provisioned with three loop rules on notify only: exact prompt repeat, a 25-call per-trace cap, and a $5.00 per-trace cost cap. They don't count against your plan's rule limit. Leave them alerting for a week, see what they catch on your real traffic, then switch one to block.
Where firings show up
The Overview tab has a Loop detection panel with firings split by detector, and Loopiest workflows beside it, which is usually the more useful half. The dashboard labels the two detectors Cap and Hash cycle.
152 firings on this project. The cap did most of the work; the repeat detector found 34.
The Audit log has a Loops tab for the individual firings. Open the run in the trace view to read it call by call and see where it started going in circles.
Loop rules are on the free tier. Start for free, or read the loop detection reference, the recipe for blocking runaway agents, or how we stop loops.