Analysis · curated 26 Jul 2026
Model Denial of Service in LLM Deployments · LLM Security Review
First reported · updated · 4 reports hiflylabs.com
Coverage timeline
Why it matters
Denial of Wallet turns the elastic, metered pricing of LLM endpoints into a financial attack surface that request-count rate limits miss, so defenders must denominate limits in tokens and dollars and budget recursive agent loops as strictly as strangers.
An explainer on Denial of Wallet attacks against pay-per-token LLM endpoints, filed under OWASP LLM10:2025 Unbounded Consumption, describing how attackers abuse legitimately-exposed inference endpoints to run up unsustainable cost while keeping the service up. The piece contrasts it with LLMjacking (credential theft), enumerates vectors like request flooding, oversized inputs, and long reasoning chains, and recommends token/dollar-denominated limits, output caps, timeouts, per-identity budgets, and centralized enforcement via an AI gateway.