Agent-run cost drift

Expanded Definition

Agent-run cost drift describes the cumulative cost increase created by autonomous or semi-autonomous agent behaviour over time, especially when the agent repeatedly retries tasks, expands context, re-queries tools, or enters loops. In agentic systems, the individual action can look inexpensive, but the repeated sequence changes the actual cost profile of the workload. NHI Management Group treats this as a governance and reliability concern, not just a billing issue, because the same patterns that raise spend can also signal unstable orchestration, weak guardrails, or poorly bounded autonomy.

The concept overlaps with prompt bloat, token overuse, tool-call sprawl, and uncontrolled recursion, but it is broader than any single cause. Industry usage is still evolving, so no single standard governs the term yet. In practice, teams often monitor it alongside controls informed by the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework, because both emphasise risk visibility, measurement, and operational oversight.

The most common misapplication is treating rising spend as a procurement problem, which occurs when teams ignore repeated agent actions and only review model pricing after costs have already compounded.

Examples and Use Cases

Implementing agent governance rigorously often introduces monitoring overhead, requiring organisations to weigh autonomy and speed against tighter spend controls and more detailed observability.

• An internal support agent retries a failed API call several times, multiplying token usage and tool fees while appearing to “just keep working.”
• A research agent continually expands its working context by reloading prior messages and retrieved documents, causing prompt growth that steadily increases per-task cost.
• A workflow agent loops between planner and executor steps because success criteria are ambiguous, creating repeated inference calls that inflate the cost of a single case.
• A coding agent repeatedly asks the same repository tool for refreshed output after minor errors, turning a short remediation task into an expensive chain of tool interactions.
• A security assistant that uses retrieval and summarisation without bounded depth can drift into large, repeated context expansions, which is especially relevant when the system must remain auditable under the CSA MAESTRO agentic AI threat modeling framework.

Teams typically identify the pattern by correlating per-task cost with retry counts, prompt length, and tool-call frequency rather than by looking only at monthly invoice totals. The OWASP Top 10 for Agentic Applications 2026 is useful here because it helps security teams think about unsafe autonomy patterns, not just model misuse.

Why It Matters for Security Teams

For security teams, agent-run cost drift matters because runaway spend is often a symptom of weak control boundaries, not merely inefficient architecture. When agents are allowed to retry without limits, expand context indefinitely, or chain tools without stop conditions, the organisation loses predictability over both cost and behaviour. That creates governance risk in production, especially where agents can reach sensitive systems, invoke privileged workflows, or process secrets and operational data.

This is where identity and authorisation design intersect with agent economics. If an agent has broader-than-necessary access, it can both spend more and do more damage when loops occur. Controls inspired by MITRE ATLAS adversarial AI threat matrix and broader AI governance guidance help teams distinguish ordinary inefficiency from abuse, prompt injection fallout, or malicious orchestration. The Anthropic report on an AI-orchestrated cyber espionage campaign also shows why unbounded agent activity cannot be treated as a purely financial concern.

Organisations typically encounter the full impact only after a production spike, at which point agent-run cost drift becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• How can organisations prevent agent privilege drift across human and workload systems?
• What should organisations measure to detect drift in agent behaviour?
• Who should be accountable when an AI agent or service account causes access drift?
• What breaks when microsegmentation assumes every asset can run an agent?