Catching rogue AI behavior with identity-aware analytics
Source
Cloudflare
Author
Cloudflare
Date
Key takeaways · AI-distilled
Absolute spend thresholds do not work for AI usage, because $500 can be a normal session for a heavy user while $50 from an AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition → that always spends $5 is a 10x break. So each session is scored against that account's own 95th-percentile session cost over 30 days.
One threshold alone would drown admins in noise, so an alert needs two: more than 2x the user's own p95 and above the org-wide p99 session cost (about $200 in Cloudflare's own traffic), plus a dollar floor so a micro-user's 500x blip over pennies never fires.
The hardest behavior to catch is a trusted account doing more of what it is already permitted to do — no new tool, no blocked action, no policy tripped. A sudden break from an account's own baseline is often the first visible sign of a stolen credential or a runaway agent.
People and agents leave different fingerprints: an agent summarizing tickets every three hours is tight and consistent, a human is irregular and messy. The same size deviation is therefore noise for one and a real signal for the other, so baselines must be per-account.
Shared API keys destroy attribution, and the fix is to put an identity provider in front of the gateway: each authenticated request carries a verified user ID in its metadata, which turns spend limits into per-person budgets that can block or fall back to a cheaper model.
Terms in this piece · Glossary
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
LLM — A large language model — the neural network behind tools like Claude and ChatGPT, trained on huge amounts of text to predict what comes next.
Why it matters
Teams routing LLMA large language model — the neural network behind tools like Claude and ChatGPT, trained on huge amounts of text to predict what comes next.Full definition → traffic through a gateway get a concrete way to attribute spend and spot runaway agents, and the availability change is actionable today.
Key quotes
“One report from Stanford University found that 59% of organizations said knowledge gaps were their biggest obstacle to responsible AI governance.”
“Solving these issues takes two things: a verified identity on every request (so a spike has a name behind it), and a picture of what normal looks like for that identity.”
“Absolute thresholds fail here: a $500 jump from a heavy user might be normal, while a $50 session from an agent that always spends $5 is a 10x change that could otherwise slip by.”
“Shared API keys make it almost impossible to tell who is using an AI service or apply the access rules we already have for employees”
