Unbounded Consumption: When AI Agents Never Learn to Stop Spending - Cybersecurity Insiders

Summary

This is defensive analysis of 'unbounded consumption,' ranked sixth in OWASP's 2026 Top 10 for LLM Applications, which describes the absence of controls on how much compute, cost, or resource an LLM request may consume. Rather than causing downtime, the failure lets service costs climb far past budgeted levels — a pattern called denial of wallet — and can also enable model theft.^[0]

Forcepoint researcher Jyotika Singh frames the risk as a family of five vectors: denial of wallet through leaked API keys, agent tool fan-out from attacker-seeded linked content, reasoning loop exhaustion via crafted prompts, context accumulation in long-running sessions, and model extraction through mass querying of exposed endpoints — each of which inflates cost without necessarily violating the agent's instructions.^[0]

The reasoning-loop-exhaustion vector is independently corroborated by academic work: the OverThink slowdown attack injects benign-looking decoy reasoning problems into external context to force reasoning LLMs to emit far more hidden reasoning tokens (up to 46x on tested datasets, up to 17x for coding agents), demonstrating that token-amplification is a measurable, evasive threat and that newer, costlier reasoning models are increasingly exposed.^[0][24]

How it works

Context accumulation exploits the fact that, in a long-running session without reset controls, the model reprocesses the entire conversation transcript with every new message, so cost grows with the transcript length — an example support chat open for 150+ exchanges saw per-message cost increase roughly 100x by the 100th turn.^[0]

Agent tool fan-out abuses an agent's normal retrieval behavior: an attacker compromises a document the agent is likely to fetch and seeds it with hundreds of fake related links that themselves point to further links, so a single legitimate research task expands into a runaway chain of retrievals that spends the victim's compute budget without violating the agent's instructions.^[0]

Reasoning loop exhaustion is realized concretely by the OverThink attack, which injects optimized decoy reasoning challenges (e.g. Markov decision processes, translation, or graphic comprehension tasks) into available context; individually benign, these decoys force the reasoning model to generate large volumes of hidden reasoning tokens while still returning contextually correct answers, evading safety filters and producing 12x–46x token increases on tested datasets.^[0][24]

Key takeaways

• Unbounded consumption is primarily a runaway-cost (denial-of-wallet) and model-theft risk rather than a downtime risk, so operators must treat compute cost as a security signal and cap it explicitly.^[0]
• The risk is a family of distinct vectors — leaked-key denial of wallet, agent tool fan-out, reasoning loop exhaustion, context accumulation, and model extraction — each needing its own inexpensive control such as token caps, step limits, loop detection, and least privilege.^[0]
• Reasoning models are an escalating target: the OverThink research shows attacker-injected decoys can multiply hidden reasoning tokens by up to 46x (and up to 17x for coding agents), and newer reasoning models with higher per-token cost are themselves more vulnerable to such amplification.^[24]

Defensive actions

• Impose hard spending and token caps on LLM inference.: Cost-based ceilings, rather than request counts, bound the exposure from denial-of-wallet and token-heavy vectors that would otherwise let costs climb far past budgeted levels.^[0]
• Limit the number of agent steps and loop-backs and detect repetitive loops.: Agent tool fan-out and reasoning/tool loops expand a single legitimate task into a runaway chain of expensive calls; step budgets and loop detection stop the cascade.^[0]
• Apply sandboxing and least-privilege access controls to agents and their tools.: Constraining what an agent can reach and do limits how far attacker-seeded content can drive fan-out and resource consumption.^[0]
• Protect and rotate API keys and restrict access to inference endpoints.: Denial of wallet via leaked API keys, and model extraction through mass querying of exposed endpoints, both depend on reachable/credentialed inference paths.^[0]
• Centralize inference control behind an AI gateway.: A gateway such as Cloudflare AI Gateway provides a single point to route and control AI requests across providers, enabling consistent enforcement of the caps and limits above.^[0][11]