LLM Cost Anomaly Detection for AI Agents

Quick answer

LLM cost anomaly detection for agents should watch spend by workflow, retry loop, model fallback, and progress state. A provider bill spike is the last signal, not the first one.

What makes agent spend weird

Agent costs do not behave like normal API usage. A single task can spawn retries, background checks, large context reads, and fallback model calls. The expensive part may be one broken workflow, not broad product growth.

Signals worth tracking

• cost by workflow and run id
• retry cost by error cause
• model fallback rate
• tokens spent since last status update
• background-task spend by cron or heartbeat
• cost per completed artifact

Progress matters

Some expensive runs are good. A deep research job that produces a durable artifact may be worth it. A cheap loop that produces nothing is not.

The best anomaly signal is spend increasing while the progress artifact does not change.

How Clawback helps

Clawback is built around agent behavior, so teams can see which workflows are burning tokens and whether that spend is attached to useful output.

FAQ

What threshold should I start with?

Start with workflow-relative thresholds. A heartbeat and a coding phase should not share one dollar limit.

Should I alert on every expensive run?

No. Alert on unexpected spend, repeated retries, and spend without progress.

Is provider usage data enough?

No. Provider dashboards rarely know which agent workflow caused the cost.