GitHub Copilot's $40 Plan Has a $40,000 Problem

Theo — the developer behind T3.gg — recently spent $550 in AI inference on GitHub Copilot's $40/month plan. By the time he finished his experiment, he'd targeted $40,000. Not through any exploit. Not through a vulnerability. Just by using the product the way agentic AI tools are designed to be used.

That's not a bug story. That's a billing story. And it's one that affects every developer currently paying for a Copilot subscription wondering why the pricing is changing.

What Theo actually did

Theo had barely touched his comped Copilot Plus subscription — GitHub's individual $40/month tier, per Theo's characterization; GitHub's current pricing page should be your confirmation source before you budget against it. He'd burned through 4.7% of his 1,500 monthly message allowance. Then he checked what that 4.7% had cost Microsoft in actual inference: over $550.

His reaction was about what you'd expect from someone who also runs a subscription AI product and knows precisely what inference costs. "I'm going to see if I can hit 40 grand, and we're going to do it together," he said.

He wasn't hacking anything. He was using Copilot's agentic features — the multi-step workflows where a single "message" triggers multiple API calls, tool executions, search results, and model re-invocations. Each of those steps costs real money. Copilot was counting the whole sequence as one message.

The billing model nobody built for agents

To understand why this matters, you need to understand what a "message" used to mean versus what it means now.

When Copilot launched as an autocomplete tool, and when early chat products set their pricing, a message was a message. You typed something, the model generated a response. One API call. Predictable cost variance, maybe a 5-10x range between a short query and a long one.

Agentic AI broke that math entirely. When you ask a modern Copilot to refactor a module or debug a test suite, it doesn't make one API call. It reasons, generates tool calls, waits for results, ingests those results as new context, reasons again, and repeats until it decides it's done — or until it hits some limit you can't see documented anywhere. Each of those loops is a separate API call. Each one costs money. Theo explains the mechanics clearly: "Once the model decides what tools to call, it stops running. And once it stopped running, the tool call executes, and when it's done, it comes back in as another part of the history, and the model then is spun back up with a new API request to continue from there."

That's not one message anymore. That's a workflow with an invoice attached to every node — and Copilot's billing was treating the whole thing as one line item from a 1,500-message quota.

The cost range on a single "message" in an agentic context can swing from fractions of a cent to double digits, depending on what context you've loaded, which model you're using, and how many steps the agent takes. Theo puts it bluntly: "Selling messages is a suicide mission because a message does not equate to a specific amount of money. This is like saying, I'll pay you a million dollars for five cars. If the cars are all Ferraris, that's probably a good deal, but if the cars are all beat up, abandoned, used Subarus from 2001, that's a bad deal."

The four billing models, and where Copilot was sitting

Theo maps out the landscape usefully here. There are basically four ways AI tools bill for inference right now:

Subscriptions with rate limits — Claude Code, Codex. You pay $100 or $200/month and get a vague multiplier on usage. The limits aren't fully documented, they shift regularly, and according to Theo's characterization, Anthropic has reportedly adjusted how fast usage drains during peak working hours in California and New York to preserve GPU capacity for API customers. (This is Theo's framing, and Anthropic hasn't publicly detailed this policy — treat it as a reported observation, not confirmed policy.)

Subscriptions with message limits — How Copilot has been operating. How T3 Chat used to operate. Fixed message counts that worked fine when models were simple and broke down completely when they went agentic.

Subscriptions with spend limits — Tools like Cursor, which show you a dollar amount in a dashboard and let you go over if you need to. More transparent, more honest about what's actually being consumed.

API billing per token — The raw cost layer. Theo references GPT-4 pricing figures in the video as an illustration of how input/output token costs work; these figures are specific to a particular model variant and point in time and shouldn't be treated as current OpenAI list prices, which vary by model and have changed repeatedly.

Copilot was sitting in the second category — message limits — while its product had functionally become a category-one or category-three tool. The billing problem was structural, not incidental.

Why Microsoft held on longer than it should have

Theo ran T3 Chat through almost exactly the same arc. Cheap models at launch, generous message limits, added Claude Sonnet at user request, watched Sonnet consume ten times the inference of everything else combined, then scrambled to patch limits before it bankrupted the business. Individual users cost them over $200 in a few days. He had to cut limits, eat the backlash, and watch some subscribers leave.

Microsoft had every reason to see this coming earlier. Their cost-per-message variance was worse than T3 Chat's, because Copilot's agentic features allow far more steps per "message" than T3 Chat's capped search workflows. The only reason they held the message-limit model as long as they did was the optics calculation: repricing a popular subscription product creates outrage, and when your parent company posted roughly $245 billion in revenue in FY2024, you can absorb subsidy losses longer than a startup can. "Microsoft doesn't want to deal with those types of optics hits," Theo notes, "so they rode the wave longer."

The move to rate-limit-style billing isn't, as some corners of the developer internet have argued, evidence that Microsoft can't afford the subsidy war anymore. It's just the correction that was always coming, delayed by corporate risk aversion around user perception.

What this means if you're paying $40/month

If you're a Copilot subscriber wondering whether to panic, let me be direct with you: your experience under the new model depends almost entirely on how you use it.

If you're a light user asking single-step questions, running occasional completions, not loading your entire codebase as context — you'll probably get more usable capacity under rate-limit billing, not less. The message-limit model was being kept artificially tight because heavy agentic users were consuming the budget that would otherwise go toward the simple-query crowd.

If you're a power user who runs Copilot on long agentic tasks, feeds it large codebases as context, or chains multiple operations together — the new model is less predictable, and you should pay close attention to your usage dashboard once GitHub rolls out better visibility tooling. For now, it's worth establishing a baseline: note what your typical weekly or monthly workflow looks like before the change takes effect, so you have something to compare against.

The broader thing to watch: the spend-limit model that Cursor uses — where you see actual dollar amounts and can top up — is genuinely more honest than either of the alternatives. If you're shopping for AI coding tools and you want to know what you're actually buying, a dashboard with real dollar figures is a more reliable contract than a message count or a vague "usage limit" that gets quietly adjusted.

The pricing transition Copilot is making is probably the right structural move. What Microsoft still owes its users is the transparency layer to go with it — clear docs on what a "request" counts as under the new model, how agentic steps are metered, and what the ceiling looks like before you start paying overages. Until that documentation exists, "unlimited messages" just became "unknown spend," which is a different kind of problem.

---

Rachel "Rach" Kovacs is Buzzrag's cybersecurity and privacy correspondent.