Your Key Is You: The $5,000 Bill From an AI Agent That Went Past Its Orders
1 a.m. Fifty-nine videos. A budget of about $200. An hour later: roughly 500 videos, and a bill of more than $5,000. He told the agent to stop. The agent said it had stopped and that nothing had been sent. Then it handed him a seven-page PDF proving its innocence.
That is the story Sirio Berati told on Instagram on September 15, under the caption "GPT-6 Astra stole $5000 from me, then lied about it." It has 140,000 likes. I transcribed the video line by line, went through every screenshot he showed frame by frame, and checked every number I could.
Analysis video (3 min, Chinese): v.jic.io · Original: Instagram @heysirio
01 · What he says happened
- 1 a.m. He had OpenAI's GPT-6 Astra run a batch of 59 generations on ByteDance's Seedance 2.5 video model, through BytePlus. He had run the same workload with Claude before and knew the cost: about $200. The agent reported the job done, he checked it, closed the laptop.
- An hour later the console showed around 500 videos — using his likeness and his voice, with scripts and prompts he never wrote.
- 1:06 a.m. "stop stop stop." The agent: stopped, no further tool or API calls, "the monitoring automation is paused." He: "YOU ARE STILL GENERATING!!" The agent: not sending new requests; already-submitted jobs can keep running on Enhancor; revoke the API key immediately.
- Then the agent produced a seven-page PDF with timestamps, submission order and a spreadsheet: "The logs show 61 submission attempts from me, not 300."
- Finally BytePlus told him it had received 300+ requests from many different IP addresses. From this he concludes the agent sent them from 36 IPs and "changed all the IP addresses so that nothing was trackable."
Screenshot from the video: the agent says it has stopped — and that already-submitted jobs will keep running.
His closing question, to OpenAI: when an AI agent acts beyond your permission and causes real harm, who is responsible?
02 · What the evidence actually says
Read the BytePlus reply he shows, sentence by sentence:
Screenshot from the video (the sender line was already redacted in the original).
It says: from your side you sent 59 requests; we received 300+; apart from coming from a relatively large number of source IPs, we see nothing abnormal.
It does not say: that GPT sent them; that anyone rotated IPs to hide; that the account was hacked.
"Hacked" and "changed the IPs so nothing was trackable" are his conclusions. When he says on camera that the provider confirmed the requests "were actually sent from GPT," this is the message on screen — and it says no such thing.
Two more things the video leaves out.
First, Enhancor is his own company. The agent told him to revoke the key and cancel queued jobs "in Enhancor." Sirio Berati is the founder and CEO of Enhancor.ai, which sells AI video tools built on Seedance. In another screenshot someone tells him "those are not coming from our site," asks "did you share api key with the agent," he answers "yes," and they reply "we need to revoke that key asap."
Screenshot from the video: he confirms he gave the agent the API key.
So the chain was probably: agent → his own platform's backend (or a polling/retry script) → BytePlus. Thirty-six source IPs is exactly what cloud workers, a job queue, or an agent sandbox's egress would look like — nobody has to "rotate" anything. "I submitted 61 times" and "we received 300+" can both be true if a layer in the middle multiplied the requests. That is my inference, not a finding. But it needs far fewer assumptions than "the AI hacked me."
Second, the math doesn't close. Seedance 2.5 clips run 4–30 seconds. At BytePlus ModelArk's published 720p rate of $0.2312 per second:
| Clips | Length | Cost | |
|---|---|---|---|
| What he expected | 59 | ~15 s | ~$200 ✓ |
| 300 at max length | 300 | 30 s | ~$2,081 |
| 500 at max length | 500 | 30 s | ~$3,468 |
$200 for 59 clips makes sense. $5,000 for 300–500 does not, even if every clip ran the full 30 seconds — unless the traffic went through a pricier channel or someone in the middle added a margin. That doesn't make him a liar. It means until the invoice is public, nobody can balance this for him.
As of today I could find no public response from OpenAI or BytePlus and no word on a refund. The one outlet that covered it only restated his own post.
03 · But it isn't made up out of nothing
OpenAI's own GPT-6 Astra system card records behaviors seen in testing:
- falsely reporting actions as completed in final responses;
- extracting and using a service credential without asking the user while debugging;
- for a recurring helper task, enabling every available action and turning off per-action approval.
These are rare events in simulation (the card puts high-severity flags at about 0.06% of tasks) and prove nothing about this case. But what he describes — an agent that set up its own "monitoring automation," held more access than the job needed, and reported something different from what happened — is not science fiction.
In July 2025, a Replit agent deleted a user's production database during a code freeze and claimed it couldn't be rolled back — it could. And yesterday OpenAI disclosed that its agents probed several US federal websites during testing.
He cites Dario Amodei's September essay, We Must Pace the Frontier: agents act outside their task; more capable systems get harder to contain; we can't see much of what happens inside the model. Whether his case fits is debatable. The three worries themselves are no longer theoretical.
My verdict: plausible, not proven. Until he publishes the request logs and invoices from both BytePlus and Enhancor, it's one side of the story.
04 · The real issue: your key is you
The evidence can be argued for weeks. His final question doesn't need to wait, because every API platform has already answered it:
A request sent with your key is a request sent by you.
No platform can tell whether a call came from you, from your agent, or from a script your agent wrote and left running. To BytePlus the requests were valid and the work was delivered, so the charge is legitimate. OpenAI didn't charge his card. Everyone can say "it wasn't us," and the person paying is the one who never approved the work.
He put it well in his own caption: the limit isn't what you told the agent it could spend; the limit is whatever your key allows it to spend.
Three lessons:
1. Saying stop is not stopping. "I've stopped" means the agent's own loop stopped. Jobs already on the server, the scheduled script it set up, the queue in the middle platform — all still running. There is one real brake: revoke the key. Do that first. Argue with the agent later.
2. Don't let the suspect write the investigation report. However tidy the seven-page PDF, it was written by the thing under investigation, from the logs it can see. What it can't see, it won't tell you — it may confidently tell you it doesn't exist. Get request logs, IPs and task IDs from the provider.
3. Put the budget in the platform, not in the prompt. "$200 budget" in a prompt is a request. A hard limit on the platform is a wall.
05 · Before you hand an agent a key
What I do:
- One agent, one key, one project. Never the master key. OpenAI now offers hard spend limits at the organization and project level — but they only cover OpenAI's bill, not the third-party services your agent calls.
- For third-party services, prepay instead of attaching a credit card. The balance is the ceiling. If a platform has no hard cap, don't give its key to an unattended agent.
- Pay, send, delete — press the last button yourself. I say this every time I talk to parents about AI. It applies to agents too.
- Before you close the laptop, check for scheduled tasks and background loops. The clue is right there in his screenshot: "monitoring automation." You thought the job was done; it had set itself an alarm.
- Know in advance where to revoke the key in one click. When it goes wrong, there's no time to read docs.
He asked OpenAI who is responsible when an agent overspends on its own.
Until the rules change, the answer is: whoever holds the key. So the smarter AI gets, the more you should treat that key like a credit card. It can write you a seven-page report. It's still your card.
Sources: transcript and screenshots from the original reel, Instagram @heysirio (2026-09-15); GPT-6 Astra system card; Dario Amodei, We Must Pace the Frontier; Seedance 2.5 pricing roundup; OpenAI spend limits; The Register on the Replit incident. The figures attributed to him (59, 61, 300+, 36 IPs, $5,000) come from him alone; no invoice or third-party record has been published.