Cybersecurity glossary
What is Unbounded Consumption?
Learn what unbounded consumption is in LLM applications, how attackers or bugs run up tokens, tool calls, and cloud spend, and how quotas, timeouts, and caches keep inference from becoming a blank check.
Definition
Unbounded consumption is an LLM application failure in which missing limits on tokens, requests, context size, or tool-using loops allow a user or attacker to exhaust money, GPU time, or downstream quotas—without needing to ‘break’ the model’s answers.
Why unbounded consumption matters
Inference is metered. Unbounded consumption is what happens when the meter has no cap: anonymous demos, missing max-tokens, agents that retry forever, or RAG that stuffs the entire corpus into one prompt.
You do not need a clever jailbreak. A script that asks for ‘write a 50,000-word report’ in a loop will do. The incident looks like a cloud bill, a throttled production queue, or both.
How consumption runs away
Find an unmetered surface
Public demo, leaked API key, or an internal agent with no budget.
Maximize work per call
Huge inputs, huge max-output, expensive tools, or retrieval of thousands of chunks.
Repeat
Concurrency and loops multiply a costly call into a flood.
Hold scarce GPUs
Long generations occupy workers so legitimate traffic queues.
Burn downstream quotas
Each tool call hits paid SaaS, mail, or search APIs.
Invoice or outage
Finance sees the bill; users see timeouts. Sometimes both.
Cost drivers to cap
Tokens in and out
Context window stuffing and ‘write until stop’ generations.
Tool steps
Agents that browse, code, and retry without a step budget.
Retrieval volume
Unbounded top-k or recursive query rewriting that fetches the whole index.
Concurrency
Many parallel streams per tenant against a shared GPU pool.
Wallet versus availability
| Focus | Unbounded consumption | Model denial of service |
|---|---|---|
| Primary harm | Money, quota, and noisy-neighbor cost | Nobody else can get an answer |
| Typical attacker goal | Make you pay or degrade quality economically | Take the feature offline |
| Shared controls | Authn, caps, timeouts, queues | The same, plus capacity and WAF/bot controls |
| Unique angle | Per-tenant budgets and cost anomaly alerts | Pathological prompts that hang decoding |
- Require authentication on any non-trivial inference endpoint.
- Set max input tokens, max output tokens, and hard timeouts per request.
- Enforce per-user and per-tenant daily spend and concurrency caps.
- Cap agent steps, tool calls, and recursive retrieval.
- Cache identical or near-identical prompts where the product allows.
- Alert on cost spikes and GPU queue depth, not only on HTTP 500s.
- Treat leaked model API keys as payment-card-equivalent incidents.
- Load-test with large contexts before launch; know your worst-case dollar per request.
The practical takeaway
Unbounded consumption is an LLM feature with no budget: tokens, tools, and loops that scale until the bill or the queue breaks.
Cap every dimension of work, bind it to a tenant, and watch cost as a security signal. If a stranger can hold a GPU for a minute, they can also hold your wallet.
Related security terms
Model Denial of Service
Availability-focused exhaustion of model capacity, often overlapping this risk.
Resource Exhaustion
Classic application resource-starvation patterns that still apply.
Rate Limiting
A primary control, incomplete if a single request can be huge.
Unrestricted Resource Consumption
OWASP API analog: costly calls without quotas.
Excessive Agency
Agent loops that keep calling tools until the bill explodes.
Frequently asked questions
What is unbounded consumption in simple terms?
Someone (or a buggy agent) makes the model work far too hard or too often, and you pay in GPU time, API invoices, or a frozen queue for everyone else.
Is this just DDoS?
DDoS is mostly availability. Unbounded consumption emphasizes cost and quota: a ‘denial of wallet’ that can also cause [model denial of service](/glossary/model-denial-of-service).
Why are LLMs special here?
Cost scales with tokens, retrieved chunks, and tool steps. One malicious prompt can be expensive even at low request rates.
What is a slow-token or long-context trick?
Attackers send huge inputs, demand huge outputs, or force pathological decoding so each request holds a GPU for a long time.
Do rate limits per minute fix it?
Not if each allowed request is a 200k-token generation with ten tool calls. You need per-request caps too.
Are agent loops in scope?
Yes. A planner that never stops is unbounded consumption even with one user.
How do you control it?
Authn, per-tenant budgets, max tokens in/out, timeouts, concurrency limits, cached answers, and kill switches on tool loops.
References
Explore authoritative guidance and frameworks related to unbounded consumption.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.