My request count looked normal.

Traffic was mostly flat. There was no sudden wave of new users, no runaway background job, and no obvious model upgrade hiding in a deployment.

But the LLM bill kept climbing.

My first instinct was to look for the usual suspects: a pricing change, an expensive model accidentally pushed to production, or someone hammering an endpoint.

None of those explanations held up.