What is the first step during an LLM cost spike?

Preserve provider billing, gateway telemetry, traffic, model mix, token types, retries, and deployment evidence before making changes.

How should teams contain an LLM cost spike?

Use the narrowest control that stops new spend, give it an owner and expiry, and preserve quality-critical and revenue-critical traffic.

How do you identify the cause of a cost spike?

Check volume, model mix, token composition, retries, context, tool fan-out, and provider rates, then compare cost per successful task with baseline.

Quick answer: When LLM spend spikes, do not start by changing the model. First preserve the evidence, confirm the billing signal, and identify whether the change is volume, rate, mix, or efficiency. A good response...

A production runbook for an LLM cost spike

Updated August 27, 2026 · first published August 27, 2026

When LLM spend spikes, do not start by changing the model. First preserve the evidence, confirm the billing signal, and identify whether the change is volume, rate, mix, or efficiency. A good response contains the incident before it destroys the data needed to explain it.

First 15 minutes: confirm and preserve

Capture the provider invoice or usage export, current traffic, model mix, token types, retries, and recent deployments. Record the start time, affected accounts, and dashboards used. Compare provider billing with gateway telemetry so a dashboard bug does not trigger an unsafe production change.

Next 30 minutes: contain safely

Apply the narrowest control that stops additional damage: pause a runaway workflow, cap an agent, route background work to batch, or disable one newly released feature. Preserve quality-critical and revenue-critical traffic. Every emergency control needs an owner, an expiry time, and a rollback condition.

Find the driver

Check volume first, then model mix, token composition, retries and fallbacks, context length, tool fan-out, and provider price changes. Compare p50 and p95 cost per successful task with the prior period. A rise in requests with flat cost per task is demand; a rise in cost per task is an efficiency or mix problem.

Close the incident

Remove temporary controls only after the metric returns below its threshold and quality remains within SLO. Write a timeline, dollar impact, root cause, detection gap, and permanent action. Reconcile the final impact to provider invoices and tag the affected feature so the postmortem can be audited.

The runbook is successful when the team can answer what changed, what was protected, how much it cost, and which control prevents recurrence.

LLM cost monitoring
Agent spend guardrails
AI spend variance analysis

Want this applied to your own LLM spend? FinOps LLM runs a free audit of your AI costs and shows where the savings are. Book free audit →

Back to research