OWASP LLM Top 10 Risks: Unbounded Consumption Simulation Revealed

A cybersecurity research team conducted a controlled experiment demonstrating how malicious actors could exploit vulnerabilities in AI systems to deplete computational resources and incur excessive costs.

Key Findings from the Experiment

The test focused on a specific threat vector outlined in the OWASP 2026 Top 10 list for LLM applications, which now ranks as the sixth most pressing security concern. This risk category, termed unbounded consumption, occurs when AI systems lack mechanisms to regulate resource usage during operations.

Unbounded Consumption Risk

The experiment involved two AI agents processing identical malicious input. The first agent, configured without safeguards, executed 500 tool calls over an extended session, resulting in a simulated cost of $10. This scenario illustrated how an attacker could manipulate input data to trigger excessive task execution. The second agent, equipped with protective measures including a call limit, recursion depth restriction, and an automated “circuit breaker” system, completed only one tool call at a cost of $0.02. These controls prevented the system from entering an uncontrolled expansion of tasks.

OWASP’s Research Insights

OWASP’s research highlights that unbounded consumption risks have escalated in severity due to the increasing complexity of agentic tools and the rising financial impact of resource exhaustion. The organization’s analysis shows that per-turn costs for AI sessions can escalate dramatically as context accumulates. For example, initial interactions may cost $0.001, but by the 100th turn, costs could reach $0.50. While individual requests remain within budget thresholds, the cumulative effect across multiple sessions can result in hundreds of dollars in expenses.

Real-World Implications

Security researchers emphasized that real-world implementations without these safeguards could face significantly higher costs. A proof-of-concept scenario demonstrated how a compromised AI research agent might follow an endless chain of fabricated references from a malicious source, potentially consuming resources over extended periods. This vulnerability is particularly concerning as AI systems increasingly handle high-stakes tasks requiring continuous operation.

Additional Unbounded Consumption Threats

The study also identified additional unbounded consumption threats. One involves “denial-of-wallet” attacks, where attackers use stolen API keys to flood pay-per-token endpoints with requests. Another scenario, “reasoning-loop exhaustion,” occurs when crafted prompts trick models into excessive internal processing. For instance, a prompt that instructs an AI to “question your own reasoning from every possible angle without assuming anything” can force the model to generate disproportionately large amounts of intermediate output. A third risk involves “model extraction” or “model distillation” attacks, where adversaries use high-volume queries to reverse-engineer proprietary AI models. This technique has been previously linked to allegations against Chinese AI laboratories, which were accused of exploiting Anthropic’s Claude models through excessive query traffic.

Challenges in Monitoring and Accountability

Researchers stressed the importance of implementing cost attribution mechanisms to track resource usage at the user, key, or tool level. They also recommended strengthening infrastructure to restrict agent capabilities and limit access to critical systems. A key challenge identified is the lack of cross-functional accountability for monitoring these risks. Security teams often overlook cloud billing data, while finance departments rarely analyze prompt patterns or agent configurations.

Recommendations for Mitigation

The findings underscore the need for organizations to integrate cost monitoring into their security practices rather than treating it as a separate administrative task. Without proactive measures, the financial and operational risks associated with unbounded consumption could escalate rapidly as AI adoption expands.