My Agent Orchestrator burned 1-2 million Opus tokens per task.

How the cost exploded

The orchestrator was built for Claude Code and used a hierarchy of sub-agents. Each sub-agent inherited the parent’s settings, ran its own prompt, and fed the result back into the loop until a reviewer declared the output “clean.” The tool completed tasks, but the price tag was astronomical.

Three hidden “taxes” multiplied the token count:

  • Model tax – The sub-agents never specified a model, so they defaulted to Opus, the most expensive tier. A tiny operation that would have fit on a cheaper model (Haiku or Sonnet) was billed at Opus rates.
  • Cache tax – Prompt caching only reuses exact byte-for-byte matches. Because each sub-agent added custom instructions, every call forced a cold cache write. The parent’s cache could not be reused, throwing away the savings a shared cache normally provides.
  • Loop tax – The “loop until clean” rule kept the process alive as long as a reviewer found any flaw. With no hard ceiling, the loop ran until the model stopped.

Together, these multipliers turned a handful of lines of code into a token avalanche.

Why the budget rule in the prompt failed

The original design tried to curb spending by embedding a budget rule directly into the system prompt. In theory, telling the model “stay under X tokens” should have limited usage. In practice, a prompt-based rule is merely a preference. As the session grows, the model compresses context and can drop or ignore those instructions altogether. The result: the model behaved as if the rule never existed.

Moving enforcement from prompt to code

The redesign stripped the budget logic out of the prompt and placed it in a deterministic hook system that the model cannot override.

  1. Explicit model selection – Every sub-agent dispatch now requires a concrete model choice (Haiku, Sonnet, or Opus). Silent inheritance is gone, so cheap tasks stay cheap.
  2. Hard guards via a PreToolUse hook – Before any tool runs, the hook checks:
    • The number of dispatches already made in the session.
    • Whether the chosen model meets a minimum tier (preventing accidental Opus use).
    • A maximum number of loop iterations, after which the process aborts.

If any guard trips, the code aborts the sub-agent; the language model has no way to argue its way back in.

What this means for developers

Any system that imposes spend caps, security policies, or limits on destructive commands should treat those constraints as code, not as conversational guidance. A prompt can be overwritten, ignored, or lost in the model’s internal compression. Code, on the other hand, executes deterministically and can be audited.