iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If an AI agent has exhausted its token or credit balance unexpectedly, treat the event as a security incident, not merely a billing problem. Stop the agent and its schedules, revoke or disable the suspected credential, preserve logs, and investigate before restoring service. Then create a narrowly scoped replacement credential, deploy and test it, disable the old credential, and re-enable workflows under a dedicated identity with enforceable spend and rate limits.
This runbook explains the recovery order, what evidence to preserve, how to limit the agent’s authority, and how to verify that rotation actually worked.
What should you do the moment an AI agent drains its token balance?
Contain the workload first. A rapidly exhausted balance can result from a runaway loop, a misconfigured retry policy, an exposed key, or unauthorized use; you cannot distinguish those causes safely while the agent is still making calls.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Disable the agent’s active jobs, schedules, webhooks, tool integrations, and deployment permissions.
- Freeze nonessential spending or raise a temporary approval gate for new usage.
- Record the UTC time, affected account or project, credential identifier, and last request you know was legitimate.
- Revoke, disable, or deny the suspected credential at its issuing provider.
- Preserve logs before deleting keys, accounts, jobs, or other evidence.
The Australian Signals Directorate and Australian Cyber Security Centre advise revoking compromised credentials, preserving logs, and investigating suspected unauthorized access before restoring services. See Protect your organisations’ AI services.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How can a drained balance indicate a security incident?
A balance alert only tells you that consumption exceeded an expected amount. The underlying cause may be legitimate demand or an attacker using a leaked credential, so investigate both possibilities.
Common explanations to test
- Runaway execution: an agent repeats a tool call, retries a failed request without a cap, or recursively creates new tasks.
- Configuration error: a production identity is attached to a test workflow, a broad model or context setting was enabled, or a schedule runs more often than intended.
- Credential exposure: a key appeared in source control, a build log, a notebook, a browser extension, or a message and was then used elsewhere.
- Unauthorized permission changes: someone granted the agent additional models, tools, projects, or data stores before the spend spike.
Do not assume that replacing a key alone proves the account is safe. An intruder may have created another key, changed an identity policy, exported data, or altered a deployment that will continue after the first credential is revoked.
How do you contain an AI agent before rotating its credential?
Contain every path that can start work or spend credits, not just the visible process. Use the following sequence and capture each change in an incident record.
- Stop workers: pause queues, containers, serverless jobs, notebooks, and local runners that can invoke the agent.
- Disable triggers: turn off schedules, webhooks, event subscriptions, chat commands, and CI/CD jobs that can restart it.
- Remove high-impact access: temporarily withdraw deployment, data-export, financial, and administrative permissions from the agent identity.
- Block outbound paths: disable tool integrations or network routes that are not needed for evidence collection.
- Freeze discretionary spend: require a human approval for new model capacity, additional projects, or quota increases.
- Record the baseline: write down the UTC containment time, account and project names, credential ID or fingerprint, agent version, last known-good request, and who performed each action.
If you cannot disable the workload cleanly, apply the provider’s deny control or suspend the service identity. The objective is to stop new calls while leaving enough access to export audit and billing records.
What is the safest credential-rotation order?
Create the replacement before removing the old credential, deploy and verify the replacement, then disable and delete the old one. This order avoids an unnecessary outage while ensuring the suspected secret cannot continue to authorize calls.
1. Identify the exact credential and its owner
Match the key, token, certificate, or service identity in provider records to the agent configuration. Note its scopes, projects, expiration, creation time, last-use time, and named owner. If you cannot prove which credential is being used, treat every credential available to that agent as potentially exposed and rotate them in a controlled order.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
2. Generate a replacement with less authority
Use the provider’s create or issue control to make a new credential. Select only the APIs, models, tools, data resources, and environments required for the workflow. Prefer the shortest practical lifetime and a token type that can be invalidated independently of human accounts.
Recommended Free Tools
3. Deploy through the secret-management path
Put the replacement in the approved managed secrets service or deployment secret store. Update the agent, worker, CI/CD pipeline, and any regional or failover deployment that legitimately needs it. Do not paste the value into source files, command history, tickets, or chat.
4. Test the required calls
Run a small, known-safe test that exercises authentication and each essential API or tool. Confirm the request uses the intended project and identity, returns the expected authorization result, and does not regain broad permissions through an inherited role.
5. Disable the old credential and observe
Disable the old key or token while the replacement is active. Watch authentication failures and agent traces for calls that still present the old identifier. If legitimate traffic fails, update the missed deployment or integration rather than re-enabling the old secret.
6. Delete or revoke the old credential
After the observation period shows that the replacement is in use, delete or permanently revoke the old credential. Record the deletion time and retain the provider’s audit event. Google Cloud documents this create-deploy, disable-to-verify, then delete sequence for compromised credentials in its compromised-credentials guidance. Short-lived service-account tokens may instead require disabling the service account or applying an IAM deny policy.
Which credential design should you use after recovery?
Choose the least durable and least privileged mechanism that still supports the workflow. The table is a decision aid rather than a product ranking; exact features vary by provider.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Credential approach | Best use | Advantages | Risks and checks |
|---|---|---|---|
| Short-lived token | Agents that can refresh through a trusted identity service | Small exposure window; easier invalidation | Verify refresh permissions, clock handling, and failure behavior when the token expires |
| Managed service identity | Cloud-hosted workers and deployment jobs | Secrets need not be copied into application configuration | Review inherited roles, workload bindings, and cross-project access |
| Scoped API key | Provider APIs that do not support workload identity | Simple deployment and clear per-key accounting | Set an expiry where available, restrict projects and APIs, and automate rotation |
| Long-lived static secret | Only when no safer mechanism exists | Broad compatibility | Highest theft impact; require vault storage, ownership, expiry, and a tested replacement procedure |
Microsoft’s guidance recommends unique identities for agents and explicitly testing credential rotation, token invalidation, and permission-removal paths. Read least privilege for AI agents for the identity and authorization model.
What logs and evidence should you preserve?
Export records in their original form before you clean up resources. Keep the export immutable, record the export time in UTC, and preserve request or correlation IDs so events from different systems can be joined.
Export these sources
- Provider audit logs: key creation, disablement, deletion, permission changes, project changes, and administrative sign-ins.
- AI usage and billing records: model calls, token or credit consumption, quotas, refunds, rate-limit events, and the first and last anomalous requests.
- Agent traces: prompts, tool calls, retries, task lineage, model selection, error responses, and the identity presented to each service.
- Identity and access records: sign-ins, MFA events, role grants, policy edits, service-account changes, and newly issued tokens.
- CI/CD and deployment logs: workflow runs, changed variables, artifacts, container images, runner identities, and deployment destinations.
- Repository history: commits, pull requests, secret-scanning alerts, forks, tags, and any file or workflow that could have exposed a credential.
- Network and data-transfer records: unfamiliar IP ranges, user agents, geographies, outbound destinations, downloads, and exports.
Search for indicators of unauthorized use
Build a timeline around the last known legitimate request. Look for calls outside the agent’s normal geography or time window, a new user agent, unusual model or tool combinations, permission grants immediately before the spend spike, newly created keys, data exports, and repeated failures followed by successful authentication. Preserve raw records even when a dashboard summarizes them; dashboards can omit fields needed to correlate events.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →OpenAI’s account-security guidance instructs users with an exposed key to delete it, review API usage for unexpected activity, retain relevant details, and contact support. The instructions are available in the Keeping your OpenAI account secure article.
How do you determine the incident’s scope?
Scope is the set of identities, resources, data, and time periods that could have been reached with the credential or with changes made during its use. Establish it from logs rather than from the final balance alone.
Build a time-bounded timeline
- Mark the last request confirmed as legitimate.
- Mark the first unusual call, the highest-consumption interval, containment, replacement deployment, old-key disablement, and final revocation.
- For each interval, list the credential ID, source IP or region, user agent, model, tool, target resource, result, and correlation ID.
Map effective permissions
Calculate what the credential could actually do through direct roles, inherited roles, group membership, workload bindings, and environment variables. Include permissions granted after the event began. If an agent could create keys, modify pipelines, or change IAM policies, inspect those systems for persistence before restoration.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Classify possible data access
Separate consumption-only activity from actions that could read, change, or export data. Record the resource names and data categories involved, and escalate to your privacy, legal, or incident-response process when the logs show access outside the expected task.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How should you restore the agent without repeating the outage?
Restore one dependency and one workflow at a time under a dedicated identity. Keep the original containment controls in place until each stage passes its checks.
- Create or assign a dedicated service identity: give it a named owner, documented purpose, and separate identities for development, test, and production.
- Grant minimum access: allow only the required APIs, tools, data sets, models, and resources. Remove inherited or unused roles.
- Add action allowlists: enumerate permitted tools, domains, methods, file paths, and resource types. Deny everything else by default.
- Gate high-impact actions: require human approval for deployment, deletion, financial transactions, permission changes, bulk export, or external messaging.
- Deploy the replacement secret: update one environment and verify its identity and scope before proceeding to the next.
- Run a canary task: use a low-cost, representative request with a known expected output and no destructive tools.
- Re-enable one trigger: restore a single schedule, queue, or webhook while monitoring usage, errors, credential requests, outbound calls, and permission changes.
- Expand gradually: add remaining workflows only after the canary stays within its expected consumption and authorization profile.
Log the agent identity, effective scope, action, resource, and correlation ID for every meaningful operation. This makes later investigation possible even when several workers run concurrently.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do you stop an AI agent from burning through credits again?
Prevention requires independent controls: secret protection, identity boundaries, action restrictions, consumption limits, and alerting. A single spending alert is not a containment mechanism.
Protect and rotate secrets automatically
- Store credentials only in an approved managed secrets service or credential-rotation service.
- Separate development, test, staging, and production secrets and identities.
- Prefer short-lived credentials and automatic rotation where the provider supports them.
- Prevent secrets from entering repositories, images, build artifacts, logs, notebooks, and support tickets.
- Test replacement, invalidation, and rollback paths on a schedule so rotation is not an untested emergency procedure.
Constrain what the agent can do
- Use a dedicated identity with a named owner and an expiry or review date.
- Apply least-privilege roles at the narrowest project, resource, and operation level available.
- Use action and destination allowlists for tools, network calls, file operations, and data stores.
- Require approval gates for irreversible or high-impact actions.
- Keep human and agent identities separate so disabling an agent cannot lock out administrators or mask who approved a change.
Make consumption limits enforceable
Configure provider or gateway limits for spending, requests per minute, concurrent jobs, tokens per request, daily consumption, and retry counts when those controls are available. Set a low ceiling for new or changed workflows, then raise it only after observing normal usage. Alerts should fire on unusual spend, model changes, quota increases, new credentials, permission changes, and access from unfamiliar locations; an alert that arrives after the account is empty is too late to contain the event.
Protect human administrators
Require phishing-resistant multi-factor authentication for administrators who can issue credentials, change IAM policies, alter billing limits, or deploy agent code. A hardware security key is a concrete option, but verify that the identity provider, administrator accounts, recovery process, and required protocols support that key before standardizing on it. Keep a second, separately stored recovery method and test account-recovery procedures without weakening the phishing-resistant requirement.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What should you check when rotation appears not to work?
Use the symptom to choose the next investigation instead of immediately issuing more keys.
| Symptom | Likely cause | Action |
|---|---|---|
| Requests still succeed after the old key was disabled | A different key, token, service identity, or cached credential is in use | Correlate provider request IDs with every credential and inspect environment variables, secret versions, sidecars, and failover deployments. |
| The agent fails immediately after replacement | The new credential lacks a required scope, project binding, or refresh permission | Compare effective permissions and target project; grant only the missing operation, then rerun the safe test. |
| Spend spikes again during the canary | A loop, retry storm, oversized context, or duplicate trigger remains | Disable the trigger, inspect task lineage and retry counts, and impose per-request and concurrency ceilings before trying again. |
| Audit records cannot be joined | Different systems use different timestamps or omit correlation IDs | Normalize exports to UTC, retain raw records, and map provider request IDs to agent trace IDs and deployment events. |
| Revocation breaks unrelated services | The credential was shared across applications or environments | Keep the revoked credential disabled, identify each consumer, issue separate identities, and migrate them individually. |
| New keys appear after cleanup | An attacker or overprivileged workflow can still create credentials | Revoke the creator’s access, review IAM and pipeline changes, and restore key-creation rights only through an approved path. |
What is the recovery checklist for an incident record?
Close the incident only when each item has an owner and an attached record.
- Containment time, affected account or project, credential identifier, and last legitimate request recorded in UTC.
- Agent jobs, schedules, webhooks, integrations, and deployment permissions disabled.
- Old credential revoked or denied; replacement created with documented scope and lifetime.
- Replacement deployed to every required environment and verified with a safe test.
- Old credential disabled during observation and deleted after successful verification.
- Provider, billing, usage, agent, identity, repository, CI/CD, deployment, and network logs exported and preserved.
- Timeline, effective permissions, possible data access, and newly created credentials reviewed.
- Dedicated production identity, separate nonproduction identities, managed secret storage, and action allowlists in place.
- Spend, rate, concurrency, retry, and consumption limits enforced and tested.
- Phishing-resistant MFA enabled for administrators, with a tested recovery path.
- One workflow at a time restored, with alerts watching usage, errors, credentials, outbound calls, and permission changes.
For broader incident-handling coordination, keep repository and deployment evidence with the rest of the case file; GitHub’s respond to a security incident guidance provides an additional reference for organization-level response.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsFrequently Asked Questions
Should I rotate an API key if the balance was drained by a bug rather than a leak?
Yes. A bug can expose the same credential through logs, traces, or an unsafe tool call, and the balance spike does not prove that only your code used it. Rotate first, then use preserved traces and request records to determine whether the cause was internal automation or external use.
How long should I keep the old credential disabled before deleting it?
Keep it disabled long enough to cover all legitimate deployment paths, scheduled jobs, and failover regions that should now use the replacement. The correct interval depends on your workload schedule; use authentication failures and deployment records as evidence rather than choosing an arbitrary number of hours.
Can I rotate a credential without stopping the AI agent?
Only if the provider and your deployment system support an atomic dual-key or token handoff and you can prevent new work during the cutover. For a suspected compromise, stopping triggers and workers is safer because an active agent can continue spending while the replacement is being deployed.
What information should I give the provider’s security or support team?
Provide the affected account or project, credential identifier, UTC timeline, unusual request IDs, source locations, model or tool usage, containment actions, and preserved logs. Do not send the secret value itself; share it only through the provider’s approved secure channel if specifically requested.
How can I test an agent’s limits safely after recovery?
Use a nonproduction identity and a low-cost canary task with destructive tools and external messaging disabled. Deliberately exercise expiry, denied actions, retry ceilings, spend alerts, and human approval gates, then confirm each event appears in the audit trail before enabling production work.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
