Unbounded Consumption: Denial of Wallet and Model Theft

Every inference call costs money and compute. LLM10 broadens the old denial-of-service problem to fit that reality: when a model's usage is unbounded, an attacker doesn't need to crash your service to hurt you — they can run up a crippling bill, exhaust your capacity, or slowly copy the model itself. OWASP renamed this category from "model denial of service" precisely because the cost dimension changed the game.

The premise is that LLM inference is unusually expensive and unusually easy to trigger. A single request can consume large amounts of GPU time and, on a hosted API, real money per token. Where a traditional DoS aims to take a service down, LLM10 attacks aim to make it ruinous to keep up — or to extract value from it — and the same lack of limits enables both.

From denial of service to denial of wallet

Denial of wallet is the signature attack: on a pay-per-token API, an attacker floods the endpoint with expensive requests — long inputs, large max_tokens, and prompts that force verbose output — turning your cloud bill into the weapon. There is no outage to alert on, just an invoice that climbs until someone notices. Resource exhaustion is the classic form: enough concurrent or oversized requests to starve legitimate users of capacity and degrade the service for everyone.

The more strategic threat is model extraction. By querying a model systematically and harvesting its outputs, an attacker can steal proprietary prompts, approximate the model's behaviour, or train a cheaper clone on its responses — stealing the asset without ever touching the weights. Unbounded query access is what makes that economical.

Putting bounds on it

• Rate-limit and quota per user. Enforce limits on request frequency, tokens, and total spend per API key and per user, with hard caps and billing alerts so cost can't run away unwatched.
• Cap input and output size. Validate and bound prompt length and max_tokens, and set timeouts so no single request can consume unbounded compute.
• Require authentication and monitor usage. Don't expose inference anonymously; baseline normal consumption and alert on the systematic, high-volume query patterns that signal extraction or abuse.
• Throttle and degrade gracefully under load. Queue, throttle, and shed excess load so a burst degrades rather than exhausts — and legitimate users keep working.
• Detect extraction behaviour. Watch for the wide, methodical querying that model-cloning requires, and rate-limit or block sources that exhibit it before the asset walks out the door.

Agentic systems make all of this sharper: an autonomous loop that calls the model repeatedly can burn budget on its own, no attacker required, which ties LLM10 back to the restraint that excessive agency (LLM06) demands. Meter and bound every model endpoint the way you would any expensive shared resource — and to bound them, you first have to know they exist. You can't put a quota on an AI service you never knew was running.