LLM10: Unbounded Consumption
When AI systems consume resources without limits — enabling denial-of-service attacks and runaway costs.
AI Has a Different Cost Model
Traditional software has a relatively flat cost curve. Once deployed, a web application can serve additional users at minimal marginal cost. AI is different. Every request to a large language model consumes compute resources proportional to the length and complexity of the request. There is no free lunch in AI — every token costs money.
Unbounded consumption is what happens when there are no limits on how much those tokens can be requested, by whom, and how often. The result can be financial exhaustion, service unavailability for legitimate users, or deliberately triggered runaway costs designed to damage your organization.
Click the card to reveal the explanation
You Launch an AI Customer Service Bot — No Auth Required
Marketing launches a public-facing AI chatbot for product support. No login required — any visitor can use it. It's featured in a press release. Within 48 hours, usage is much higher than expected.
What actually happened: a competitor's automated script began sending requests to your chatbot at 2,000 requests per minute, 24 hours a day. Each request was crafted to maximize compute usage — long, complex questions requiring detailed responses. After 72 hours, your AI API bill is $67,000 above your monthly budget. Real customers are experiencing rate limiting and slow responses. The chatbot is effectively down for legitimate users.
This is both a financial attack and a denial-of-service attack — and it required nothing more than an HTTP request to a public endpoint.
- No authentication = no attribution, no limits, no cost controls
- AI services have no automatic cost ceiling — you pay for what was consumed
- Public AI endpoints without rate limiting are existential budget risks
- This also happens accidentally: a developer's test script runs in a loop overnight
Attack Patterns and Business Risks
Direct DoS via Request Flooding
Automated scripts send massive volumes of requests. Legitimate users are rate-limited or denied service. If there's no per-user rate limiting, one source can exhaust the entire capacity allocated to real customers.
Sponge Attacks (Compute Maximization)
The attacker crafts requests designed to consume maximum compute — extremely long context windows, complex reasoning tasks, requests that force multiple tool calls. Fewer requests, same damage. Harder to detect by volume alone.
Accidental Consumption (No Attack Required)
A developer's misconfigured integration loops indefinitely. An agent gets stuck in a retry loop. An employee discovers an AI tool and shares it across the entire company without IT's knowledge. Budget overruns happen without any attacker involved — just missing limits.
How to Build Cost-Controlled AI Infrastructure
1 / 5🔑 Require authentication for all AI endpoints
No anonymous access to AI services. Every user or application must authenticate. This enables attribution (who is using what), rate limiting per entity, and cost allocation.
🚦 Implement per-user and per-application rate limits
Set limits on requests per minute, tokens per hour, and total spend per period. These limits should be calibrated to legitimate use cases — and alerts should fire before the limits are hit.
💰 Set budget alerts and hard caps
Configure your AI provider accounts to alert at 50%, 80%, and 100% of budget. Set hard spending caps that prevent charges above a defined ceiling. This protects against both attacks and accidents.
📊 Monitor for unusual patterns
Anomalous request patterns (high volume from a single source, unusually large requests, off-hours usage spikes) should trigger automated alerts. Cost anomaly detection is as important as security anomaly detection for AI.
⏱️ Apply timeouts and complexity limits
Set maximum context window sizes for user-submitted content. Apply timeouts to long-running requests. Limit the number of tool calls an agent can make per task. These bounds prevent compute-maximization attacks.
Questions Your CFO and CTO Should Be Able to Answer
- What is our total AI spend this month, by team and by application?
- What are the per-user and per-application rate limits on our AI services?
- What alerts fire if AI costs exceed budget thresholds?
- Can we disable a specific AI application or user's access within 10 minutes of identifying misuse?
- Is our AI spending covered in our monthly financial monitoring dashboards?
If these questions cannot be answered, Unbounded Consumption is an active risk — regardless of whether anyone is actively attacking you.