Traditional denial of service exhausts a server’s capacity. LLM applications add a second target: cost. OWASP’s 2025 Top 10 for LLM applications covers this as Unbounded Consumption (LLM10:2025), which occurs when an application lets users run excessive and uncontrolled inference, leading to denial of service, economic losses, model theft, and degraded service (OWASP, LLM10:2025 Unbounded Consumption).
The attack patterns OWASP lists are specific to how models are served. A flood of inputs of varying length exploits processing inefficiencies. Inputs that keep exceeding the context window, or queries built to be computationally demanding, tie up resources. A “denial of wallet” attack sends a high volume of requests to run up a pay-per-use bill. The same unmetered access also enables model extraction: querying an API enough to train a copy, or using its outputs as synthetic training data for a functional replica. Agents widen the surface, because a single request can fan out into many model calls and tool calls. The weakness is not limited to hosted APIs: researchers at Cambridge and Toronto showed that “sponge examples,” inputs crafted to maximize energy use and latency, could slow language models and raise their energy consumption by a factor of 30, and described them as the first denial-of-service attack aimed at the machine-learning components of a system (Shumailov et al., Sponge Examples).
OWASP’s mitigations are mostly standard capacity controls applied to inference. Validate input size, rate-limit and set quotas per user or key, set timeouts and throttle expensive operations, cap the number of queued and total actions, and monitor resource use for anomalies. It also recommends limiting what the API exposes, such as logprobs and logit bias, and designing the system to degrade gracefully under load instead of failing outright.
For agent builders, the practical version is a budget on every loop: a maximum number of steps, tool calls, and tokens per task, enforced outside the model. How to cut AI agent costs covers spend controls that also limit this exposure, excessive agency covers the related problem of what an agent is allowed to do, and the AI security topic collects the episodes on attacks against AI systems.
Sources
- OWASP: LLM10:2025 Unbounded Consumption — The OWASP entry covering excessive inference, denial of service, economic loss and mitigations.
- Shumailov et al.: Sponge Examples: Energy-Latency Attacks on Neural Networks — Inputs crafted to raise energy use and latency, described as denial of service against ML components.