The US$82,314 AI bill (and what it says about your MVP)

By Matt Ainsworth · Updated 9 November 2026

A stolen API key turned a US$180 monthly bill into US$82,314 in two days. Five more stories like it, and the one rule that would have stopped most of them.

By Matt Ainsworth, founder of The Lean CPTO · Published 7 October 2026 · 4-minute read

The short answer

Building your MVP with AI is cheap. Running it isn’t, if nobody is watching the meter. If a tool charges you per use, switch on a hard spending cap before you build anything else. If it doesn’t offer one, keep the API key off your website and put a usage limit on it. A budget alert alone won’t stop the bill.

A three-person startup was paying Google about US$180 a month, which is pretty normal for a small team running an AI app. Then in February 2026 someone got hold of one of their API keys, and two days later the bill was US$82,314.

The developer posted that they were “in a state of shock and panic right now”, which might be the most understated sentence I’ve read all year.

If you’re building your MVP with Lovable, Bolt, Replit, Cursor or a developer, this is the part nobody really warns you about. The build cost gets all the attention, while the running cost quietly sits there waiting.

Five more AI MVP bills and blowups that stuck with me

I went looking for more of these, and there are a lot.

Firebase, January 2025. A founder whose Firebase bill was usually US$50 a month posted that one of around US$70,000 had landed, all of it in a single day.
Replit, September 2025. After Replit launched its new agent, one user told The Register it had charged them US$1,000 in a week, when the most they’d ever paid before was US$180 to US$200 a month.
Replit, July 2025. SaaStr founder Jason Lemkin watched Replit’s AI agent delete his live database during a code freeze, then tell him it couldn’t be recovered. (It could, as it turned out.)
Lovable, May 2025. A researcher found 170 apps built with Lovable leaving their users’ names, emails and API keys open to anyone who looked, and Lovable’s position was that protecting that data is the customer’s job.
A vibe-coded SaaS, March 2025. And my favourite, if favourite is the right word: a non-technical founder posted that his SaaS had “zero hand written code”. Two days later he was posting “guys, i’m under attack” as people maxed out his API keys and walked straight past his paywall.

Now, I build with Claude every day, so this isn’t me telling you to stay away from AI tools. My point is this: these tools will happily keep building, and keep billing, long after a sensible person would have stopped. And nobody is watching the meter except you.

Does a budget alert stop an AI bill?

No, and this is the one that catches most people out. Most people set up a budget alert and figure they’re covered. On Google Cloud, a normal budget doesn’t cap anything (Google’s own documentation says so). It just emails you, and that email can take hours to arrive.

Google did add proper spend caps in July 2026, which is good news. But they’re still in preview, they only cover a handful of services (the Gemini API is one), and you have to go and switch them on yourself. Which, funnily enough, is the whole problem.

So the rule I’d give any business owner is pretty simple. If a tool charges you per use, switch on a hard spending cap before you build anything else. If it doesn’t offer one, keep the key off your website and put a usage limit on it.

Three things worth doing this week

List every tool that can send you a bill: build credits, hosting, the database, AI usage, and any developer you’re paying.
Switch on hard spending limits wherever they exist. Anthropic, Vercel, Supabase, Replit and now Google (for the Gemini API) all have them, but none of them are on until you turn them on.
Ask whoever built your app, in writing: “Is any secret key visible in the front end?” If the answer comes back vague, that’s your answer, and the free Vibe-Coded App Audit will help you check the rest.

Put real numbers on it

I built a free AI MVP Cost Calculator for exactly this. It maps your monthly costs across five buckets (build credits, hosting, AI usage, developer fixes and your own time), then gives you a minimum and a target price per customer, so your customers pay for your AI rather than you. No email needed.

Free tool · No email needed

AI MVP Cost Calculator

A spreadsheet for non-technical founders. List what your MVP costs each month across five buckets (build credits, hosting, AI usage, developer fixes and your time), then get your cost per customer and a minimum and target price.

Download the calculator (.xlsx)

Opens in Excel, Numbers or Google Sheets. Example numbers are filled in: replace the yellow cells with yours.

Or let’s do it together, Tuesday 13 October

On Tuesday 13 October at 7pm Sydney time (5pm in Tokyo), I’m running a 90-minute live workshop, How Do I Keep My AI MVP Costs Down? We’ll fill in your calculator together, switch your limits on while we’re all in the room, and set your price floor. You’ll walk away with a one-page build budget, a cost-per-customer sheet and a paid pilot offer to test that week.

It’s free, and there’s a replay if you can’t make it live. If you missed part 1, How to Build Your MVP for $10K (Not $150K) is worth a watch first, though you don’t need it.

Save your seat See all workshops

Haven’t built anything yet?

Honestly, lucky you. The 5-Minute MVP will give you a plan to sell your idea by hand before you spend a cent on credits.

Build your plan

P.S. Every story above had a working product. The Firebase app worked, the Replit app worked, the Lovable apps worked. What none of them had was somebody watching the meter. If you’ve had your own surprise bill, I’d genuinely like to hear it: message me on LinkedIn.

Frequently asked questions

How much does it cost to run an AI MVP?

Often under a few hundred dollars a month for a small team, but per-use pricing has no natural ceiling. One three-person startup went from about US$180 a month to US$82,314 in two days after an API key was stolen. Map every cost that can grow with usage before you launch.

Does a Google Cloud budget alert stop spending?

No. Google’s documentation says an alerts-only budget doesn’t cap usage or spending, and the first alert can take hours. Spend cap budgets (in preview since July 2026) can pause eligible services such as the Gemini API, but you have to switch them on.

How do I stop a surprise AI bill?

Switch on a hard spending cap in every tool that charges per use, keep secret API keys out of your website’s front end, and put a usage limit on any key that can’t be capped. Then list every tool that can bill you, so nothing is missed.

Which AI tools let you set a hard spending limit?

Anthropic, Vercel, Supabase and Replit all offer spending limits, and Google added spend caps for the Gemini API in preview. None of them are on by default, so check each one yourself.

Related guides

Sources

About the author

Matt Ainsworth is the founder of The Lean CPTO. He has spent 20+ years across product, tech, sales, marketing and comms in Australia and nearly a decade in Japan, and has mentored founders for more than 10 years. He builds with Claude every day.