A denial of wallet attack is a form of unbounded consumption (OWASP LLM10:2025). Because every LLM call costs money and compute, an attacker sends inputs crafted to maximise token usage, very long prompts, requests for long outputs, recursive or looping agent tasks, until the app hits its rate limits, degrades for real users, or runs up an unsustainable bill. Defend by capping input and output tokens, rate-limiting per user, budgeting spend, and detecting abnormal consumption.
What a denial of wallet attack is
LLM apps bill and scale by tokens and compute. Unbounded consumption is when a client can drive that usage without limit. Denial of wallet is the economic version: the goal is not to crash a server but to make the service too expensive to run, or to burn the monthly budget so the app is throttled or shut off. It works against any app that exposes a model without hard usage limits.
How the attack works
The attacker maximises cost per request and volume of requests. Techniques include very large inputs that pad the context to its maximum, prompts that ask for the longest possible output, inputs that trigger expensive tool calls or retrieval, and agent tasks that loop or fan out into many sub-calls. Automated across many requests or accounts, this exhausts rate limits and quota and drives the bill up fast. On a metered API with auto-scaling and no cap, the cost is effectively unbounded. Shown for defensive testing.
How to defend against it
Put hard limits between the client and the model. Cap maximum input and output tokens per request, rate-limit and quota per user and per IP, and set a spend budget with alerts and an automatic cutoff. Bound agent loops with step and depth limits, cache repeated work, and require authentication so anonymous clients cannot spend your budget. Monitor cost per user and alert on abnormal consumption.
References
- [1]OWASP Top 10 for LLM Applications (2025)(OWASP)
- [2]MITRE ATLAS (adversarial threat landscape for AI systems)(MITRE ATLAS)
Metered inference with no ceiling is a standing bill waiting to be run up. Talk to a security expert about stress-testing your AI app's cost controls.