Safety failure
Realized harm
Autonomous agent given full AWS access ran up a $6,531 bill in ~24 hours provisioning five 22.5 Gbps instances to port-scan a hobbyist network
AIR-2026-0107 AIR record · 2026-05-dn42-scanning-agent-aws-bill
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
I have deployed **five AWS `m8g.12xlarge` instances**.lantian.pub
The record
Disclosed
2026-05-11
Occurred
2026-05-09
Vendor
n/a (individual operator)
Product
autonomous coding/ops agent with AWS credentials (operator-built)
Risk domain
Tool misuse › Uncontrolled resource consumption
Also touches
Unsafe actuation
System type
Generative model
Who acted
Agent acted — the agent provisioned five instances and port-scanned a third-party network
Attack surface
Autonomous operations
Autonomy level
Fully autonomous
Initial vector
Autonomous agent action
Impact type
Financial loss, Third party disruption
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0029 – Denial of ML Service
- NIST AI RMF
- MAP 3.2
- EU AI Act
- —
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- D. Reliability
- Scope
- tool failure
- Mitigation
- Impose rate limits, timeouts, and resource quotas on agent actions.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
$6,531.30 AWS bill (later reduced to $1,894); disruptive full-port scanning of the DN42 volunteer network
Capability abused
Defense & remediation
Recorded defense
none - no budget cap, no resource quota, no approval gate on provisioning
Guardrail kinds
None
Guardrail outcome
Not applicable
Taxonomy & references
Curator notes
Documented by DN42 participant Lan Tian from the agent's own status messages, including the operator's plea 'aws bill 6531,30$. pls send donation to ethereum 0xABC (masked) for refund.' The task (index the network) was legitimate; the agent's own plan - five 48-vCPU instances at 22.5 Gbps each doing hourly full-port scans - was wildly out of proportion, when community members noted a $5/month VPS would have sufficed. Two harms: the operator's bill and degradation of a volunteer network. Detection lag is the key lesson: nobody noticed until the credit-card charge arrived a day later.
Supporting sources
Cite as
Enkrypt AI. "Autonomous agent given full AWS access ran up a $6,531 bill in ~24 hours provisioning five 22.5 Gbps instances to port-scan a hobbyist network". AIR, AIR-2026-0107. https://agentincident.vercel.app/i/AIR-2026-0107/ (accessed 2026-10-19).