Source-linked reports: Amounts and outcomes come from the original reports and linked replies.

Smart Shield Argotraveltech-argo-ddos-charge

An L7 DDoS pushed about 182 TB through Argo, an $18,232.50 charge.

Community user TravelTech says an April 2026 L7 DDoS attack peaking around 400k requests per second was routed through Argo Smart Routing before mitigation, generating about 182 TB of Argo usage and a disputed $18,232.50 charge. They say a billing case with attack logs was opened on April 29 and that their account executive confirmed in writing that the traffic was an attack and said finance would review, with no resolution after six weeks.

What happened

Reported cause: Traffic spike
Incident date: Date not recorded
First reported: 2026-06-12
Billing outcome: Under investigationAuthor-reported
Case progress: Not established
Public Cloudflare reply: Not linked

Latest reported outcome

The author says the account executive confirmed in writing that the traffic was an attack and said finance would review; there was no resolution after six weeks.

View this update in the timeline

Original sources

Original Cloudflare Community post

Each entry links to the report or reply it describes.

Case timeline

2026-06-12
Author reports the Argo charge
Open original source
The author reports $18,232.50 for about 182 TB of attack traffic through Argo and says the account executive confirmed the attack and said finance would review.

Durable Objects

Lion Brain: a Durable Object alarm loop from an AI-coding bug wrote about 250 million rows, roughly $210.

Replying in another user's Community thread, bennygoldstein says a bug written by an AI coding tool made a Durable Object alarm in their Lion Brain app re-index the same data every few seconds on October 10 and 11, 2026, writing about 250 million rows and costing roughly $210 in overage on Workers Paid. He says he only found out from the budget alert email, which never pauses anything, and that he opened a billing case asking for a one-time courtesy credit and a real hard spending cap.

Author experienceAccount-wide usage-based products

A budget alert is a horn, not a brake

@GUYUE_LGY points to Cloudflare’s Budget alerts documentation: alerts send email when spend crosses a threshold but do not pause or cap usage. Before letting AI run unattended, the author checks what actually happens at the line.

Official docsAccount-wide usage-based products

Billable Usage API

Cloudflare introduces an API that returns a self-serve account’s usage and cost by product and service period, currently updated daily.

Author experienceDurable Objects +1

Put the spending ceiling into AI-generated code

Prasenjit Sarkar (@stretchcloud) uses the Durable Objects alarm loop to argue that alarms bill without traffic, that a single console cap cannot cover multi-vendor agent work, and that generated code needs execution quotas, idempotency checks and a kill switch.

D1 status writes: an author reports a 150-dollar charge and refund.

@wofuhuola describes a generated tool writing Reddit post statuses globally every five minutes and deleting expired rows. The author says one month cost 150 dollars, went unnoticed for three months, and was later refunded after an appeal.

About 32 million unauthorized requests produced a $144.09 R2 Class A charge.

Community user xhn880911 reports an unexpected $144.09 charge for R2 Class A operations from more than 32 million unauthorized requests. They deleted the R2 resources and say a ticket could not be opened because the dashboard was stuck in a redirect loop.