Sure but the exploit here isn’t prompt injection, it is an edge case in their billing that isn’t attributing agent calls correctly.

That's fair - I suppose the agent is making a call with a model parameter that isn't being attributed, as you say.