An agent called my payment API 50,000 times in 90 seconds. Here's what broke.

It was AM on a Tuesday. My lit up with 47 alerts in under a minute. "Payment endpoint: rate limit exceeded" "Payment endpoint: 429 errors" "Payment endpoint: CPU 98%" I opened the logs. What I saw made my stomach drop. Agent payments-batch-23a7 had called the /transfer endpoint 50,342 times in 90 seconds. Each call succeeded. Each call moved money. And the API key? It worked perfectly. Authenticated every single request. How we got here Three months earlier, we had built a multi-agent payment system.