They already talked to AWS and had the bill cut down to ~1800 dollars from ~6300, but they legitimately launched those processes instead of having the key stolen so the cost reduction is understandably less generous in those situations. Also potentially the agent was able to connect to more open networks and might have been running jobs on them incurring legitimate costs.