A $5,000 query that every monitor approved

One of the more instructive incidents this year is also the least dramatic: a data team received a $5,000 bill from a single AI-generated query that its resource monitors never caught.

No error. No outage. No threshold crossed. Every dashboard green throughout.

Monitoring watches for unhealthy. Agents fail healthy.

Conventional observability is built to detect systems in distress — errors, saturation, latency, failure rates. It works because software that malfunctions usually looks like it is malfunctioning.

An agent that does the wrong thing does not malfunction. It executes a valid query, gets a correct result, and returns success. Every signal your platform emits describes a system working exactly as designed, because at the infrastructure layer it is.

The query succeeded. That is the problem, and no health metric can express it.

What would have caught it

Not a better threshold. A different kind of assertion — one about outcomes rather than health. Cost per task against an expected range. Rows scanned against what the task plausibly requires. Actions taken per unit of work completed.

Those are semantic expectations, and they have to be written per workflow because only someone who knows the task knows what normal looks like. That is why they mostly do not exist: they cannot be bought as a platform default, and they require the team to state what the agent is supposed to cost and touch.

The generalisable version

For every agent in production, write down the bounds of a normal task — cost, data volume, actions, duration — and alert on departures from those, not on infrastructure health. Where a bound cannot be stated, that is a signal in itself: an agent whose normal behaviour nobody can characterise is an agent whose abnormal behaviour nobody will recognise.

The $5,000 is trivial. The same blind spot applied to a system with write access is what the more expensive incidents this year have in common.

Written by the Devence Lab research team.