Creator Night: The Bill and the Breach

The situation

The feed has recovered. Now two alerts are waiting: a destructive tool call nobody approved, and a cost alarm from a caption job that retried 940 times. They arrived together and it's tempting to treat them as one problem.

What you'll learn

• Bounded incident evidence, least-privilege containment and approval checks; capacity controls distinct from budget alerts; distinguish attack traffic from a client fault; test retry and cost changes and record the security and cost findings.

Who you work with

• 

  Lydia Roe

  Security Engineer

• 

  Amara Okafor

  ML and Data Engineer

• 

  Priya Naidoo

  Cloud Architect

• 8-BIT

  Code Nexus Internal AI Assistant

Scenes

1. 1.After recovery, the invoice
2. 2.Establish the impact, and only the impact
3. 3.Take the delete key away
4. 4.Cap the bill without switching off the feed
5. 5.Attack, or our own client?
6. 6.Fix the client, safely
7. 7.One record, two questions
8. 8.Handover

What you leave with

You established from the logs that the night held two separate problems: an agent with an unguarded delete tool and a client that retried without limit. You contained the agent with least privilege, an approval step and a capacity cap, right-sized and budgeted the runaway cost, told a legitimate client fault from a small real probe, and shipped the client fix behind new retry and cost gates as a canary. The incident record kept the security and cost halves apart.