For Heads-of · Practitioner
Unbounded resource consumption
Unrestricted or excessive inference requests lead to denial of service, denial of wallet, or facilitate model theft.
- medium
- llm
- availability
- cost
- owasp-llm
How it happens
An application places no limit on request volume, input length, or context-window usage, so a user, malicious or merely careless, can drive inference costs or compute load far beyond what the system was sized for.
Why it matters
In a pay-per-token deployment this is a direct financial attack (denial of wallet), not just an availability one, and sustained high-volume querying is also the mechanism behind several model-extraction techniques.
Mitigating controls
The controls that address this risk, ranked by effectiveness.
Inference usage quotas and rate limiting
Per-user and per-tenant limits on request volume, input length, and context-window usage for an AI system's inference endpoint.
AI system monitoring and logging
Continuous telemetry, drift detection, and audit logging of AI system inputs, outputs, and overrides.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| OWASP Top 10 for LLM Applications | LLM06 | Unbounded Consumption |
Related resources
The external sources behind this risk, from the Resources library.