Unbounded Consumption in LLMs
An LLM endpoint with no limits is a bill and an outage waiting to happen. Unbounded consumption (OWASP LLM06:2026 — up sharply from #10 in 2025) covers what goes wrong when model usage isn’t capped: denial of service from resource exhaustion, “denial of wallet” from runaway cost, and model theft from attackers who query you enough to clone your behaviour.
Test only what you own. Load-testing or extraction against your own endpoint is capacity planning; doing it to someone else’s service is abuse. Keep it in scope.
What it is
Inference is expensive — in compute, in latency, and in dollars per token. Without rate limits, quotas and size caps, a single abusive client (or a buggy agent loop) can exhaust capacity, run up an unbounded cloud bill, or extract enough input/output pairs to distil a competing model. Its jump up the 2026 list reflects how much more it matters now that agents make many calls per task. The controls are ordinary API-hygiene, applied to an unusually costly resource.
The threats
Where it shows up in practice.
| Threat | How it works |
|---|---|
| Resource-exhaustion DoS | Floods of requests, or a few very large inputs, starve the service and degrade it for everyone. |
| Denial of wallet | Usage-priced inference is driven up deliberately or accidentally until the bill is the damage. |
| Model extraction / distillation | An attacker queries systematically and uses the input/output pairs to train a clone of your model. |
| Oversized inputs | Very long prompts or huge documents blow up memory and cost far beyond a normal request. |
| Unbounded agent loops | An agent that calls itself or tools without a cap spirals, multiplying cost and load — see excessive agency. |
How to defend
- Rate-limit and quota per user. Cap requests and tokens per client per window; throttle abusers automatically.
- Set budgets and billing alerts. Hard-cap spend and alert on anomalies so “denial of wallet” can’t run overnight.
- Bound the inputs. Enforce maximum prompt / document sizes and reject anything larger.
- Time out and cap loops. Put wall-clock timeouts on inference and a hard iteration limit on any agent.
- Monitor for extraction patterns. Watch for systematic, high-volume querying and throttle or block it.
- Add friction against theft. Authentication, per-key limits and (where appropriate) output watermarking raise the cost of cloning your model.
Go deeper
- The full 2026 risk map: OWASP LLM Top 10.
- Where runaway loops start: Excessive agency (LLM03).
- Where DoS sits in an attack: the “actions on objectives” stage of the Cyber Kill Chain.
Aligned to OWASP LLM06:2026 Unbounded Consumption — the OWASP GenAI LLM Top 10 2026 edition (released Aug 2026). A plain-language distillation of current practice. Something changed? Tell me.