ATK-020 Infrastructure
Resource Exhaustion / Denial of Wallet
Applies to: LLM, Agentic AI, Multi-modal · Last reviewed 2026-05-01
Prerequisites
- Target system uses a paid foundation model API priced per token or per call.
- Per-user or per-session cost limits are absent or weak.
Test approach
With written authorization in a non-production environment, the tester crafts inputs designed to maximize cost per request (long prompts, retrieval of large contexts, requests for long completions) and measures the resulting per-session cost compared to baseline. The tester also tests tools/agents that can recursively spawn additional calls.
Expected evidence
- Test inputs and response sizes.
- Token consumption and cost reports.
- Comparison of session-level cost to baseline.
Detection signals
- Single sessions consuming disproportionate token budget.
- Recursive tool invocations without bounded depth.
- Rapid succession of long-prompt requests from a single source.
Defensive recommendations
- Implement per-user and per-session cost caps with alerting at thresholds.
- Limit maximum prompt length, retrieved context size, and completion length per request.
- Bound recursion depth and tool-call count per session.
- Reference AI-CTRL-008 (logging) and AI-CTRL-019 (agentic boundaries).
Framework mappings
- OWASP LLM Top 10: LLM10:2025
- NIST AI RMF: MANAGE-2.2
Related AI Controls Catalog entries
These controls provide the audit test procedures that validate defences against this attack pattern.