GoKawiilAI applications can rack up unexpected costs when they lack effective controls on how much compute power and other resources a request is allowed to consume.
The large language model (LLM) vulnerability, known as unbounded consumption, can take several forms, including runaway processing, service disruption, and model theft. In a report this week, Forcepoint highlighted five different ways the vulnerability — which OWASP now ranks sixth in its 2026 Top 10 for LLM Applications — can impact organizations.
Denial of Wallet
"The common thread is a missing control over how much compute, cost or resource a request is allowed to use," Forcepoint researcher Jyotika Singh wrote in the report. "Instead of downtime, the service typically stays up while its running cost climbs past anything anyone budgeted for, a pattern known as denial of wallet."
Risks tied to unbounded consumption are often easy to miss because no single request might appear malicious or exceed an organization's established usage limits, even as the cumulative resource consumption becomes costly or disruptive. Importantly, some forms of unbounded consumption do not require technical expertise or even a malicious actor.
Related:Microsoft Issues Emergency Fixes After Massive Patch Tuesday
Simple volume, misconfigured automation, or long-running sessions can drive up costs, while individual requests may appear entirely normal and evade conventional input filters, Singh noted.
Unbounded Consumption Risks
The Forcepoint report identified five ways the problem can play out. The simplest is denial of wallet, where an attacker with stolen or leaked API credentials sends a high volume of requests against a pay per use AI service and sticks the account owner with the charges. For example, a support chatbot’s staging API key could leak onto a public code repository, which an attacker could use to script tens of thousands of requests and run up a bill well in excess of application’s monthly cloud budget.
A second way the unbounded consumption problem could play out is agent tool fan out. This is where an attacker takes advantage of an AI agent's normal behavior rather than forcing it to violate its instructions.
... continue reading