cyber.hendryadrian.com
Detection & Defense · forcepoint.com

OWASP Flags Unbounded AI Inference as a Runaway-Cost Risk

· Original article ↗

Summary

The article explains OWASP’s LLM06:2026 Unbounded Consumption risk, how agents can drive runaway inference costs, and why enforced budgets, circuit breakers, and monitoring are needed.

Key points

  • OWASP’s LLM06:2026, Unbounded Consumption, covers uncontrolled inference that can cause costs to climb without taking a service offline.
  • The risk can stem from high-volume API requests or accidental automation and long-running sessions; some patterns need no attacker.
  • Described patterns include denial of wallet, agent-tool fan-out, reasoning-loop exhaustion, context accumulation, and model extraction.
  • In the article’s simulation, an agent without limits made 500 tool calls and incurred $10 in simulated cost; fan-out alerting halted the defended version after one call at $0.02.
  • Recommended controls include hard spending caps, per-run call and depth limits, fan-out circuit breakers, cost attribution, sandboxing, and keeping serving frameworks patched.
  • The article says rate limiting alone may not stop costs accumulating across otherwise normal requests, and calls for clear ownership of cost monitoring and agent controls.

Article Details

Defense Focus
Prevent and detect uncontrolled inference and agent activity that can drive excessive resource use and costs.
Detection Methods
  • Compare spending and resource use per API key, user, and tool against baselines to identify anomalous spikes.
  • Monitor agent call counts, recursion depth, and the number of follow-up items returned by each tool response; flag unusually high fan-out.
  • Track per-turn costs in long-lived sessions to identify cost growth as context accumulates.
Data Sources
  • Inference spending and resource-use telemetry, attributed to API key, user, and tool
  • Agent execution records, including tool-call counts and recursion depth
  • Tool-response data, including the number of returned follow-up topics
  • Per-turn cost and session context-growth measurements
Rule Types
  • Cost-anomaly detection against baselines
  • Fan-out threshold alerting
  • Enforced spending caps, call budgets, and recursion-depth limits
Platforms
  • Forcepoint AI Data Security platform
  • AI Agent Gateway
Defensive Actions
  • Enforce hard token-aware spending caps per API key, user, and team, and halt inference when limits are reached.
  • Apply per-run call budgets, recursion-depth limits, and cost ceilings to agent executions.
  • Halt or flag execution when a tool response returns an unusually large number of follow-up items.
  • Use state hashing to detect recursive loops before they compound.
  • Restrict agent access through sandboxing and least-privileged permissions, and keep serving frameworks patched.
  • Discover unsanctioned AI tools and enforce policy inline and in real time.

People

JyotikaIdentified as a Security Researcher II on the X-Labs Threat Research Team.

Vendors

Forcepointpath; blocking ungoverned access before it starts is the more effective one. This is the layer the Forcepoint AI Data Security platform is built around: discovering unsanctioned AI tools across the enterprise,

Products

AI Agent GatewayFor sanctioned AI use, the Forcepoint platform extends into prompt and response inspection, an AI Agent Gateway for enforcing least-privileged access for autonomous agents and a unified platform with a single policyForcepoint AI Data Security platformungoverned access before it starts is the more effective one. This is the layer the Forcepoint AI Data Security platform is built around: discovering unsanctioned AI tools across the enterprise, including

Related Articles