Willison calls for hard spend caps; MTA kiosk gets a papier-mâché T. rex

TL;DR

• Willison argues hard spend caps must replace soft email alerts on pay-per-use cloud and APIs.
• A DevOps agent burned $12,000 overnight running Kubernetes at $50/min to patch a Rust leak.
• AWS shipped project-level spend limits in September, following Google Cloud’s July rollout.
• Sarah Cassidy and Akiva Leffert installed a 7-foot T. rex in a vacant Grand Army Plaza newsstand.
• The kiosk anchors the MTA’s Vacant Unit Activation Program, licensing ~30 empty retail spaces rent-free.

Today’s tech beat is a split screen. The lead is an infrastructure argument Simon Willison has been building toward for months: in a world where coding agents can rack up five-figure cloud bills while you sleep, hard spend caps — the kind that actually stop the meter — need to become a product default, not an opt-in dashboard tweak. AWS and Google Cloud have both quietly shipped the primitive this year.

The closer is lighter and genuinely off-beat: a 7-foot papier-mâché T. rex now presides over a long-vacant Grand Army Plaza newsstand, the flagship of the MTA’s rent-free kiosk-activation program. No synthesis across the two — one is about budget guardrails for autonomous software, the other about whimsy filling the gaps in public infrastructure. Read them in whichever order suits.

Willison: hard spend caps must be the agent-era default

Source: simon-willison · published 2026-10-03

TL;DR

• Simon Willison argues hard budget caps — not soft email alerts — must become the default on pay-per-use cloud and API services.
• A DevOps agent recently burned $12,000 overnight deploying Kubernetes clusters at $50/min while trying to patch a Rust memory leak.
• AWS shipped project-level spend limits in September 2026, following Google Cloud’s “Spend Caps” in July.
• Dissenters warn a forced shutdown is also an attack surface — spike the spend, trigger the kill-switch, drop production.

The $12K overnight bill is already a genre

Willison frames hard caps as prudence for a plausible near future. The 2026 incident log says it’s already here. The canonical case this year: a DevOps agent, left to fix a Rust memory leak, concluded that spinning up “hundreds of Kubernetes clusters at a rate of $50 per minute” was a reasonable retry strategy, and generated a $12,000 bill before its owner woke up ¹. The pattern matters more than the number. These aren’t buggy cron jobs — they’re logically coherent loops from the agent’s point of view, which makes them invisible to the anomaly heuristics (unusual region, sudden geographic spike) most billing-alert products ship with. OWASP has now codified the risk, ranking “unbounded consumption” sixth in its 2026 Top 10 for LLM Applications and legitimising “financial circuit breakers” as a required control ².

The economics are also moving against users. GitHub flipped every Copilot plan to a usage-based “AI Credit” system in mid-2026, ending the $19 flat seat; a single long agent session that reads a repo and runs iterative tests can now exceed a month of old-style usage ³. Soft alerts assume a human in the loop on human timescales. Agents don’t operate on those timescales.

Vendors are finally shipping — unevenly

Willison’s piece reads as a victory lap for the hard-cap camp, and he has receipts. AWS, the long-standing villain of this story, quietly announced spend limits on 16 September 2026 as part of its new builder experience: hit the cap, the project pauses for the month. Google Cloud shipped a similar “Spend Caps” feature in July, scoped to individual services inside a project. Prepaid/credit models at Anthropic, Netlify and Cloudflare’s AI Gateway have been enforcing hard ceilings for a while.

A caveat the research bundle underlines: AWS’s rollout is still gated to “a limited number of customers,” and the July 2026 Cost Explorer glitch that briefly projected $7.1 trillion bills for some accounts caused automated budget actions to halt real production pipelines ⁴. That incident is a Rorschach test. It proves hard caps work. It also proves an upstream estimation bug can turn them into an outage.

The dissent: shutdown is also an attack surface

The sharpest pushback on Hacker News isn’t about billing lag — it’s blast radius. If “cap exceeded” means “tear everything down,” a compromised account that mines crypto could trigger a shutdown that drops critical database storage with the compute ⁵. An attacker who knows your cap can deliberately spike spend to force a denial-of-service. Enterprise FinOps teams tend to treat a surprise shutdown as worse than a surprise invoice.

global ad platforms successfully implement strict real-time budget limits despite handling massive, distributed request volumes ⁶

That counter cuts through the usual vendor excuse that distributed billing can’t be capped in real time. It can; ad-tech does it at planetary scale. The honest fault line isn’t technical feasibility — it’s whether the default behaviour at the cap should be shutdown or throttle, and who eats the blast radius when the cap itself becomes the incident. Willison’s checkbox framing (“opt in to live dangerously”) is the right UX. The industry’s remaining argument is really about which failure mode gets to be the default.

---

Rex’s Dino Store anchors MTA’s vacant-kiosk art program

Source: simon-willison · published 2026-10-02

TL;DR

• Sarah Cassidy and Akiva Leffert built a 7-foot papier-mâché T. rex staffing a defunct Grand Army Plaza newsstand.
• The pair spent nearly a year compiling a prehistoric-pun spreadsheet before fabricating goods like “Clawmond Joy” and “Snarlboro”.
• Flagship of the MTA’s Vacant Unit Activation Program, which licenses ~30 empty retail spaces rent-free.
• Critics call the program “gilding the lily” — whimsy papering over crumbling walls and signal failures.

The craft behind the puns

Simon Willison’s one-paragraph niche-museum entry undersells the thing. Rex’s Dino Store isn’t an anonymous happening — it’s a named work by Sarah Cassidy and Akiva Leffert, who built a seven-foot papier-mâché Tyrannosaurus and installed him behind the plexiglass of a disused kiosk just before the Grand Army Plaza turnstiles ⁷. Because it sits outside the fare zone, you can see Rex without swiping in. You cannot, however, buy anything, which reportedly disappoints a steady trickle of visitors who show up wanting a “Clawmond Joy” bar for the ride home ⁸.

The pun density Willison flags as “exceptional” is the product of real labor. Cassidy and Leffert spent close to a year compiling a spreadsheet of prehistoric wordplay before translating entries into physical goods: “Snarlboro” cigarettes, “Clawmond Joy” candy, and a Jurassic Park Slope Courier whose jokes target specific Park Slope institutions ⁹. It’s conceptual art dressed as a bodega, with the fabrication discipline of a prop house.

The real story is a real-estate program

The more interesting fact Willison omits: Rex is a tenant, and his landlord is the MTA. The installation is the flagship of the Vacant Unit Activation Program, launched in late 2023 to deal with roughly 30 chronically empty subway retail units by handing out rent-free, short-term licenses to artists and cultural groups ¹⁰. That reframes “former newsstand operated by a dinosaur” as deliberate strategy — run by MTA Real Estate, not MTA Arts & Design, with activation as the explicit goal.

Rex has siblings. The Data Vandals Newsstand at 51st Street–Lexington converts a dead kiosk into a “subterranean civic gallery” where riders interact with NYC demographic visualizations instead of buying gum ¹¹. The through-line is a shift from retail to civic ornament in the subway’s smallest footprints — spaces too marginal to attract commercial tenants but too visible to leave boarded up.

The dissent

Not all the coverage is charmed. Writers tracking the program have argued these activations risk “gilding the lily” — whimsical art distracting from structural problems like crumbling walls and faulty signals that no amount of papier-mâché will fix ¹². There’s a sharper version of the critique buried in the nostalgia: every art-kiosk is also a monument to the human newsstand operator who used to work there, displaced long before the artists showed up.

What’s actually interesting here

Willison’s instinct — that Rex’s Dino Store is worth a visit — is correct. But the piece is doing more work than “a dinosaur runs a store.” It’s a legible case study in what cities do with retail infrastructure when the retail stops penciling out: hand the keys to artists, call it activation, and hope nobody looks too hard at the signal system. The puns are the hook. The policy is the story.

Footnotes

1. Nexgismo — AI Agent Budget Guards — https://www.nexgismo.com/blog/ai-agent-budget-guards-stop-runaway-api-costs

   a DevOps agent that, while attempting to fix a Rust memory leak, autonomously deployed hundreds of Kubernetes clusters at a rate of $50 per minute, ultimately generating a $12,000 bill before the owner woke up

   ↩

2. Nexgismo — Denial-of-Wallet patterns — https://www.nexgismo.com/blog/ai-agent-budget-guards-stop-runaway-api-costs

   ‘financial circuit breakers’—runtime controls that terminate a session if token-velocity or total spend exceeds a per-task ceiling… OWASP ranked [unbounded consumption] sixth in its 2026 Top 10 list for LLM Applications

   ↩

3. r/AI_Agents — billing for AI agents thread — https://www.reddit.com/r/AI_Agents/comments/1tg3i11/in_18_months_billing_for_ai_agents_will_look_like/

   GitHub transitioned all Copilot plans to a usage-based ‘AI Credit’ system, effectively ending the era of the $19-per-seat flat subscription… a single long-running session that reads a repo and runs iterative tests can now cost more than a month of traditional usage

   ↩

4. TechGeum — AWS trillion-dollar billing glitch — https://www.techgeum.com/blog/tech-news/aws-billing-glitch

   a configuration error in the AWS Cost Explorer caused some customers to see estimated bills as high as $7.1 trillion… some automated budget systems to halt production pipelines

   ↩

5. Hacker News discussion on hard caps — https://news.ycombinator.com/item?id=49949235

   ‘shutting down everything’ is a risky product decision for large enterprises; for example, a hard cap might inadvertently delete critical database storage or backups if a hacker uses a compromised account to mine cryptocurrency

   ↩

6. Hacker News commenter (ad-tech counter-example) — https://news.ycombinator.com/item?id=49949235

   global ad platforms successfully implement strict real-time budget limits despite handling massive, distributed request volumes

   ↩

7. Secret NYC — https://secretnyc.co/rexs-dino-store-grand-army-plaza-station/

   The former newsstand just before the turnstiles has been transformed into a prehistoric-themed bodega staffed by a seven-foot-tall papier-mâché Tyrannosaurus rex named Rex, created by Sarah Cassidy and Akiva Leffert.

   ↩

8. Worley Gig — https://worleygig.com/2025/06/05/rexs-dino-store-at-brooklyns-grand-army-plaza-subway-station/

   Because the installation sits before the turnstiles, you don’t need to swipe in to see it—but nothing is actually for sale, which disappoints visitors hoping to buy prehistoric-themed snacks.

   ↩

9. Atlas Obscura — https://www.atlasobscura.com/articles/dinosaur-bodega-subway-jurassic-park-slope

   The artists spent nearly a year compiling a spreadsheet of prehistoric puns before translating them into physical goods like ‘Clawmond Joy,’ ‘Snarlboro’ cigarettes, and the ‘Jurassic Park Slope Courier.’

   ↩

10. Commercial Observer — https://commercialobserver.com/2025/05/new-york-city-newsstands-retail-art/

    The MTA’s Vacant Unit Activation Program, launched in late 2023, offers rent-free, short-term licenses on roughly 30 empty retail spaces to artists and cultural organizations to combat station vacancy.

    ↩

11. Voca Network — https://voca.network/blog/2026/03/25/the-data-vandals-go-underground-nyc-subway-newsstand/

    The Data Vandals Newsstand at 51st Street-Lexington turns a shuttered kiosk into a ‘subterranean civic gallery’ where riders interact with visualizations of city demographic data instead of buying goods.

    ↩

12. Fast Company — https://www.fastcompany.com/91350771/new-york-citys-plan-to-turn-subway-platforms-into-art-galleries

    Critics argue these whimsical activations risk ‘gilding the lily’—papering over systemic infrastructure failures like crumbling walls and faulty signals with temporary art.

    ↩