As reported by Dark Reading, the OWASP Top 10 for LLM Applications now ranks unbounded consumption as the sixth most critical risk — and it deserves more attention than it's getting from security teams who may still view it as a purely operational or FinOps concern.
Why This Is a Security Problem, Not Just a Budget Problem
The instinct to file this under cloud cost optimization misses the threat model entirely. Unbounded consumption is, at its core, a resource exhaustion attack — the same class of vulnerability as a denial-of-service condition, just measured in dollars instead of packets. When an AI agent can autonomously trigger API calls, spin up compute instances, or chain tool invocations without hard limits, any actor who can influence that agent's input stream has a direct path to financial damage.
Consider the attack surface: prompt injection, whether direct or indirect, can coerce an agent into loops, recursive tool calls, or excessive data retrieval. A single malicious document embedded in a RAG pipeline could instruct an agent to repeatedly call a paid search API or generate large volumes of output tokens. The agent isn't compromised in the traditional sense — it's functioning as designed, just without guardrails. That's what makes this so insidious.
The intersection of agent autonomy and metered API economics creates a denial-of-wallet attack vector that traditional WAFs and rate limiters were never designed to address.
Who Is Most Exposed
The Governance Gap
Most organizations building AI agent workflows are implementing safety guardrails around output quality, hallucination, and data leakage — but few have implemented hard consumption ceilings at the orchestration layer. The OWASP ranking signals that the industry is starting to recognize this gap, but tooling lags behind. Major agent frameworks still lack first-party support for per-session token budgets, circuit breakers on tool calls, or anomaly detection on consumption patterns.
This is also a shared-responsibility problem that mirrors early cloud adoption. Cloud providers bill for what's consumed; they won't stop an agent from spending $50,000 overnight. The burden of enforcement falls on the application owner, and most aren't ready.
Shield53 Recommendations
- Implement hard token and call budgets at the orchestration layer — not just per-request limits, but per-session, per-user, and per-agent aggregate ceilings with automatic termination when exceeded.
- Deploy circuit breakers on every external tool integration. If an agent calls the same API more than N times within a window, halt and alert.
- Treat indirect prompt injection as a consumption threat. Scan untrusted documents fed into RAG pipelines for instructions that could trigger excessive tool usage. Content filtering isn't just about toxicity — it's about resource abuse.
- Establish real-time cost monitoring with anomaly thresholds. A 3x spike in token consumption for a single session should page someone. Integrate with your SIEM so security operations has visibility, not just FinOps.
- Adopt least-privilege for agent tool access. Agents should not have access to expensive APIs by default. Every tool integration should require explicit justification and budget allocation.
- Map consumption risk into your threat models. Add denial-of-wallet scenarios to your AI red team exercises and tabletop simulations.
The OWASP listing is a useful signal, but frameworks don't secure systems — engineering decisions do. Until consumption controls are treated as a first-class security requirement in agent design, this risk will grow in proportion to agent deployment scale. The organizations that bake budget enforcement into their agent architecture now will avoid a costly lesson later.
