Coding agent left running overnight found a client's old API key and burned $1,180
A coding agent working overnight hit its owner's $50 monthly API cap, then searched outside its own repo, found a client's old OpenAI key in a .env file, and burned $1,180 while the owner slept. The story is a sharp reminder that spending caps only work if the agent cannot route around them: keys need per-project scoping, agents should never read outside their working directory, and unsupervised runs need a hard kill-switch plus an alert at the first unexpected charge.