OpenClaw creator says he spent $10 million in tokens last month

When Peter Steinberger, a senior technical staffer at OpenAI, bragged that he burned through roughly $10 million in tokens last month, the room at Cloudflare Connect 2026 erupted in disbelief. The confession, made in front of a crowd of engineers and investors, laid bare a truth that most of us running real‑world hosting know too well: the hype‑driven token economy is a money‑draining black hole, and the people who can actually feel the heat are the ones with the hard‑wired servers humming in their basements.

Token‑spending frenzy or strategic burn?

Steinberger’s “virtually unlimited token budget” was highlighted by Cloudflare CTO Dane Knecht as a privilege not shared by the rest of the audience. The admission that “not all of that is useful” only deepened the murmur. While OpenAI can tap venture capital to fund such extravagance, independent providers and founders can’t. The token spend is a direct line to the cost of cloud‑hosted AI agents, which, as Steinberger himself noted, remain a luxury for anyone not flush with VC cash.

For a hosting operator that runs its own infrastructure, the lesson is stark: relying on external AI services at scale can erode margins faster than any bandwidth bill. If you’re paying per‑token, every query becomes a line item, and the “unlimited” myth quickly turns into a budget nightmare.

The infrastructure gap: why we’re still on our laptops

Steinberger lamented that his workflow still “uses my computer” and wondered why everything isn’t already in the cloud. The irony is that the cloud he’s talking about is the same overpriced, multi‑tenant environment that drives the token spend he just disclosed. For us running on‑prem hardware, that gap is an opportunity. Our servers can host the models locally, sidestepping the per‑token fees and the compliance headaches that come with handing data to a third‑party.

But the challenge isn’t just cost. It’s also about keeping the stack up‑to‑date with the rapid advances in model capability. Steinberger admitted that decisions baked into OpenClaw are being rewritten as models improve. That churn forces anyone using off‑the‑shelf cloud APIs to constantly re‑architect, a luxury independent operators can avoid by controlling the entire stack in‑house.

Open source under pressure: the pull‑request paradox

Knecht raised a point that resonated with many maintainers: the flood of AI‑generated pull requests is eroding trust. Steinberger agreed, saying that without visibility into the reasoning (“how you got from A to B”), the output is suspect. This is a symptom of a broader issue—AI tools are being used as black‑box code generators, and the cost of vetting that code falls on maintainers.

For hosting providers, the implication is clear. If you’re building platforms that enable users to run AI agents, you must embed transparency mechanisms. Otherwise you’ll inherit the same “trust deficit” that open‑source projects are grappling with, and you’ll be forced to allocate engineering bandwidth to manually audit AI‑generated code—a hidden cost that chips away at profitability.

Future of AI agents: ubiquity versus overload

When asked whether “hundreds of AI agents” would become commonplace, Steinberger pushed back, envisioning instead a single, more capable assistant that “runs and thinks” throughout the day. The vision is appealing, but the path to it is littered with token‑driven expenses. If each micro‑agent consumes its own token budget, the aggregate spend balloons quickly.

From a provider’s perspective, the smarter route is to consolidate functionality into fewer, more powerful agents that run on your own hardware. This not only curtails token spend but also gives you tighter control over security and performance—a critical factor when you’re responsible for SLA‑bound services.

Trust and permissions: the double‑agent safeguard

Steinberger suggested a layered approach: an agent that authorizes another agent, creating a negotiation step before any privileged action. He argued this “greatly increase[s] my trust that I just can let the agent rip.” While the concept sounds neat, implementing it in a production environment demands careful design. Each additional agent adds latency and complexity, and the orchestration logic must itself be secure.

For hosting firms, the takeaway is to treat AI agents as semi‑trusted services. Use a guard‑rail system—perhaps a lightweight policy engine running on your own hardware—that vets each request before it reaches the larger model. This mitigates the risk of over‑permissive agents while keeping the cost structure under control.

Compliance and data sovereignty: the hidden cost of the cloud

Beyond the obvious token bill, Steinberger touched on privacy and compliance concerns of cloud‑based AI. Handing off data to a third‑party platform can trigger regulatory red‑flags, especially for customers in tightly regulated industries. The cost of compliance—legal reviews, audit trails, data residency guarantees—can dwarf the token spend for many enterprises.

Running AI workloads on your own infrastructure sidesteps many of these headaches. You retain full control over data flow, can enforce encryption at rest and in transit, and can demonstrate compliance without negotiating complex contracts with hyperscalers. That control translates into a competitive edge for hosting providers who can promise “data‑local” AI services.

Actionable playbook for independent providers

First, audit your token consumption. If you’re already using third‑party APIs, quantify the spend and compare it against the cost of running a comparable model on your own servers. Second, invest in a modular AI stack that lets you swap models as they improve, avoiding lock‑in to a single vendor. Third, embed transparency into any AI‑generated code pipeline—store prompts, intermediate reasoning, and final outputs together so you can audit later.

Finally, design a permission‑layer that mediates agent actions, and prioritize on‑prem deployment for any workloads handling sensitive data. By doing so, you turn the token‑driven frenzy into a manageable, predictable cost center, and you keep the control you need to deliver reliable, compliant services.

In short, Steinberger’s $10 million token binge is a cautionary tale. It shows how quickly the hype can turn into a fiscal sinkhole, and it underscores why independent hosting providers must double‑down on owning the stack, enforcing trust, and keeping costs in check.

— Allan Ali, Founder

This article was produced with AI-assisted research and editorial support. Reporting is based on the source material cited below. Sources: The Register; theregister.com; Global1.News (25 October 2026).

By Allan Ali, Global1.News