Research
Persistent Billable State: Denial-of-Wallet Attacks and Defenses in Tool-Calling LLM Agents
Publication date unknown · Discovered arxiv.org
Page published
Publication date unknown · First observed: 21 Oct 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
Tool-calling agent runtimes can turn retained, untrusted tool responses into recurring victim-funded processing, making controls before context reingestion an important defense against cost amplification.
Persistent Billable State studies denial-of-wallet attacks in which malicious or compromised tool outputs remain in agent history and incur repeated input-processing charges. Across 243 executions spanning six model families, the authors report maximum cumulative session input reaching 14,293× the corresponding first-call input. The study evaluates history transformation and host-side limits on prompt size, context growth, recursion, and cumulative spending.