AI Security · Learn

What is a denial of wallet attack?

LLM inference costs money per token. An attacker who forces your app to generate huge or endless completions can run up the bill or exhaust your capacity, a denial of service paid for by your own budget.

TL;DR

A denial of wallet attack is a form of unbounded consumption (OWASP LLM10:2025). Because every LLM call costs money and compute, an attacker sends inputs crafted to maximise token usage, very long prompts, requests for long outputs, recursive or looping agent tasks, until the app hits its rate limits, degrades for real users, or runs up an unsustainable bill. Defend by capping input and output tokens, rate-limiting per user, budgeting spend, and detecting abnormal consumption.

By Rohit Hatagale, AI Security Lead, SecureLayer7Updated

What a denial of wallet attack is

LLM apps bill and scale by tokens and compute. Unbounded consumption is when a client can drive that usage without limit. Denial of wallet is the economic version: the goal is not to crash a server but to make the service too expensive to run, or to burn the monthly budget so the app is throttled or shut off. It works against any app that exposes a model without hard usage limits.

How the attack works

The attacker maximises cost per request and volume of requests. Techniques include very large inputs that pad the context to its maximum, prompts that ask for the longest possible output, inputs that trigger expensive tool calls or retrieval, and agent tasks that loop or fan out into many sub-calls. Automated across many requests or accounts, this exhausts rate limits and quota and drives the bill up fast. On a metered API with auto-scaling and no cap, the cost is effectively unbounded. Shown for defensive testing.

How to defend against it

Put hard limits between the client and the model. Cap maximum input and output tokens per request, rate-limit and quota per user and per IP, and set a spend budget with alerts and an automatic cutoff. Bound agent loops with step and depth limits, cache repeated work, and require authentication so anonymous clients cannot spend your budget. Monitor cost per user and alert on abnormal consumption.

References

  1. [1]OWASP Top 10 for LLM Applications (2025)(OWASP)
  2. [2]MITRE ATLAS (adversarial threat landscape for AI systems)(MITRE ATLAS)
Related terms

Metered inference with no ceiling is a standing bill waiting to be run up. Talk to a security expert about stress-testing your AI app's cost controls.

Related service
AI Penetration Testing
Adversarial testing of your LLM and AI features, prompt injection, data exfiltration, and agent abuse, with reproducible findings.
AI penetration testing

FAQ

Denial of wallet, asked often

Scope an engagement

Test your AI application before an attacker does.

Our AI red team probes your LLM and agent features the way an attacker would, prompt injection, tool abuse, and data exfiltration, and ships findings with reproducible attacks and fixes your team can implement.