Unbounded Consumption
Excessive, uncontrolled inference lets attackers disrupt availability, inflict unsustainable cost (“denial of wallet”), or clone a model — exploiting the absence of controls over how compute, tokens, and money are consumed. In 2026 it rises four places.
What it is
Unbounded Consumption occurs when an LLM application allows excessive, uncontrolled inference, letting attackers disrupt availability, inflict unsustainable financial cost, or steal intellectual property through model cloning — all by exploiting the absence of adequate controls over resource use. The defining property is cost asymmetry: an attacker triggers disproportionately expensive computation at negligible cost to themselves.
The 2026 entry (widening the old Model Denial of Service, and absorbing model-extraction/theft) reflects reasoning models with large output budgets, multimodal models that inflate per-request compute, agentic architectures that amplify one request into cascading operations, and shared inference infrastructure. Traditional request-rate limiting alone is no longer enough — effective defence needs token-aware cost controls, hard spending caps, agent-level circuit breakers, and continuous cost attribution.
Common examples
- Variable-length input flood and output explosion: many inputs of varying length exhaust resources; fine-tuning poisoning can break end-of-sequence behaviour so output hits maximum length every request.
- Denial of Wallet (DoW): a high volume of operations exploits the pay-per-use model, risking financial ruin.
- Large-context abuse: repeated near-limit requests and application-side rechunking inflate per-request cost while staying just within limits.
- Reasoning-loop and thinking-token exhaustion: short, benign-looking prompts force extended-thinking models into prolonged reasoning, burning huge token budgets while bypassing input-size filters.
- Adversarial inputs optimised for overconsumption: sponge examples and adversarial visual perturbations maximise compute cost.
- Multimodal cost: images, audio, and video convert into large token counts, so one request can cost far more than a text-only equivalent.
- Model extraction and distillation theft: crafted queries collect enough outputs to replicate or fine-tune a functional equivalent; exposed logits accelerate it.
- Agent-tool fan-out: a malicious tool forces recursive or infinite tool-calling loops, driving token overuse; inference-framework flaws crash services outright.
Prevention & mitigation
- Rate-limit and validate input size. Move beyond requests-per-second to tokens-per-minute and tokens-per-day, and use pre-flight token estimation to reject requests before inference begins.
- Set hard spending caps. Non-overridable budget ceilings per API key, user, team, and cloud account that halt inference when exceeded — enforcement, not just alerting.
- Manage resource allocation. Prevent any single user or request from consuming excessive resources; degrade gracefully under load rather than failing completely.
- Sandbox the model's reach. Restrict access to network resources and internal services to limit exfiltration of extracted model information.
- Limit queued actions and scale robustly. Cap queued and total actions while using dynamic scaling and load balancing.
- Scan for adversarial perturbations. Check inputs — especially images to vision-language models — for perturbations engineered to overconsume.
- Detect resource-intensive tool loops. Baseline normal tool behaviour and flag sessions driving recursive or unbounded action without a clear end state.
- Enforce agentic circuit breakers. Apply step, recursion-depth, time, and per-run cost limits on every agent execution, using state hashing to detect loops.
- Harden inference infrastructure. Keep serving frameworks updated, disable unsafe deserialization, restrict special-token passthrough, and authenticate all inference endpoints.
Example attack scenarios
- An unusually large input drives excessive memory and CPU load, slowing or crashing the service.
- A high volume of API requests consumes computational resources and denies service to legitimate users.
- Crafted inputs trigger the model's most expensive processes, causing prolonged GPU usage and failure.
- Denial of Wallet: excessive operations exploit the pay-per-use model, generating unsustainable cost for the provider.
- An attacker uses the API to generate synthetic training data and fine-tunes a functional equivalent, bypassing traditional extraction limits.
- Adversarial image perturbations make a vision-language model overconsume tokens in its output.
- A benign-looking agentic session grows its context turn by turn — roughly $0.001 on turn one to about $0.50 by turn 100 — with no single request tripping a rate limit, yet hundreds of dollars in aggregate.
References
- OWASP Top 10 for LLM Applications 2026 — LLM06:2026 Unbounded Consumption: genai.owasp.org
- Shumailov et al. — Sponge examples: energy-latency attacks (2020)
- Li et al. — Reasoning-loop / thinking-token exhaustion (2025)
- Carlini et al. — Stealing part of a production language model (2024)
- Gao et al. — Output-length attacks via fine-tuning poisoning (2024)
How Neural Industries helps. We model the cost-and-availability attack surface of your deployment — reasoning budgets, multimodal inflation, and agent fan-out — and help you enforce token-aware caps, circuit breakers, and cost attribution.
Request an assessment →