As AI applications become increasingly integral to business operations, a growing concern is emerging about the financial implications of unbounded consumption – where AI agents run amok, racking up unexpected costs for enterprises. This vulnerability, ranked sixth in OWASP’s Top 10 for LLM Applications, can take several forms, including runaway processing, service disruption, and model theft.
The issue lies in a lack of effective controls on compute power and other resources consumed by an AI request. According to a recent report from Forcepoint, this oversight can lead to costly consequences, such as “denial of wallet” – where attackers exploit stolen or leaked API credentials to send high-volume requests against pay-per-use AI services, leaving the account owner with massive bills.
The problem is often easy to miss because individual requests may appear normal and evade conventional input filters. However, cumulative resource consumption can become costly or disruptive without any malicious intent. For instance, simple volume, misconfigured automation, or long-running sessions can drive up costs, while some forms of unbounded consumption don’t even require technical expertise.
The Forcepoint report highlights five ways this problem can play out. One example is agent tool fan out, where attackers take advantage of an AI agent’s normal behavior rather than forcing it to violate its instructions. For instance, an attacker could compromise a blog post that an AI agent is likely to retrieve and seed it with hundreds of fake related articles. When the agent encounters the content during a legitimate research task, it would follow the individual links, triggering a runaway chain of activity that could end up driving the victim’s compute costs.
Another issue highlighted in the report is reasoning loop exhaustion, which can affect models built to reason step by step before answering. An attacker could use a short prompt to get the model to repeatedly revisit and verify its own answer over and over again, or get it to work through every possible interpretation of the prompt, driving up inference costs.
Even more insidious is context accumulation, where AI models process conversation history along with each new message in long-running sessions. This can manifest without any attacker involvement, simply because the session continues for an extended period. For example, a support agent’s chat window that remains open for over 150 exchanges would reprocess the entire transcript with each response, driving up costs.
The takeaway from this report is clear: unbounded consumption poses a significant financial risk to enterprises using AI applications. To mitigate this risk, organizations must implement effective controls on compute power and other resources consumed by AI requests. This includes setting limits on request volume, configuring automation carefully, and monitoring long-running sessions for potential cost spikes. By taking proactive steps to address this vulnerability, businesses can avoid the costly consequences of unbounded consumption and ensure their AI applications remain a strategic asset rather than a financial liability.
Source: Dark Reading — 2026-09-21