Cost Runaway Circuit Breaker
A stalled AI model connection was generating 761 to 1,384 paid Claude Sonnet 4.6 calls in 60 seconds across two real reported incidents. $20-30 burned in a single minute, masked by auto-recharge so users only found out at billing. The fix is a 5-strike circuit breaker on the outer agent run loop. Reviewed and merged into core by Peter Steinberger, the project's creator.
The bug.
When an OpenClaw agent talks to a model like Claude Sonnet and the connection silently stalls, the system is supposed to time out and try again. The retry would hit the same stalled connection, time out again, retry, time out, forever. Every retry is a paid API call.
One reporter logged 761 to 1,384 paid Claude Sonnet 4.6 calls in 60 seconds across two real incidents. $20-30 burned in a single minute, masked by auto-recharge on the provider account so users only found out at billing.
The fix.
A circuit breaker at the outer agent run loop. After 5 stalled attempts in a row with no model output, the system stops trying and refuses further calls until the connection actually responds again. Worst case is now roughly $0.10-$0.30 per incident instead of $20-30. Routing semantics intentionally unchanged so existing deployments keep working.
// Outer agent run loop, idle-timeout circuit breaker
let consecutiveIdleTimeouts = 0;
const MAX_CONSECUTIVE_IDLE_TIMEOUTS_BEFORE_OUTPUT = 5;
while (running) {
const result = await runStep(ctx);
if (result.kind === "idle-timeout") {
consecutiveIdleTimeouts += 1;
if (consecutiveIdleTimeouts >= MAX_CONSECUTIVE_IDLE_TIMEOUTS_BEFORE_OUTPUT) {
throw new Error("Circuit broken, consecutive idle timeouts hit cap");
}
continue;
}
consecutiveIdleTimeouts = 0;
}Paraphrased from the merged diff. The full PR has the test file and the changelog entry.
Files touched.
- ·src/agents/pi-embedded-runner/run.ts
- ·src/agents/pi-embedded-runner/run/idle-timeout-breaker.ts
- ·src/agents/pi-embedded-runner/run/idle-timeout-breaker.test.ts
- ·CHANGELOG.md
Why this matters.
The OpenClaw contribution bar is deliberately strict: refactor-only PRs are auto-rejected, most feature requests are directed to third-party plugins, and each contributor is capped at 10 open PRs at a time. A fix only lands in core once the maintainers agree it is the right shape for every deployment.
For teams choosing an implementation partner, this case study answers the question "has your OpenClaw partner actually read the source?" The merged PR is the verifiable form of yes.
Verify it yourself.
Bring this engineering approach to your build.
Tell us about your OpenClaw project. Our team scopes the work, our in-house engineers build it, and the same people stay involved through launch and handoff. Our team replies within one business day.