What Is Denial of Wallet in AI Systems?

Denial of wallet is an attack or failure pattern that causes a metered service to generate unintended cost. The service may remain available throughout the event. In AI systems, token-heavy prompts, repeated model calls, recursive agent loops, retrieval fan-out, paid tools, and autoscaling can all amplify spend faster than a team notices.

How denial of wallet works

The attacker or faulty workflow triggers a paid operation many times or forces each operation to become unusually expensive. An AI endpoint may receive long-context requests, an agent may retry without a hard stop, or a public feature may call several models and tools per user action. Autoscaling preserves availability while increasing the bill.

This differs from a conventional denial-of-service objective. Downtime may occur, but the defining harm is uncontrolled cost. OWASP calls the related LLM risk unbounded consumption.

Why agents amplify the problem

An agent can turn one request into a sequence of model calls, searches, code runs, and paid API operations. Memory or planning defects may repeat the sequence. A compromised or rogue agent can also use valid credentials while operating outside the approved budget and owner boundary.

Measure cost per user task, not only cost per API call. A low-cost call repeated through branching and retries can dominate spend.

Controls that stop the spend

Set per-request input and output limits, per-user and per-tenant rate limits, concurrency caps, maximum agent steps, retry ceilings, tool-call budgets, and daily account limits. Enforce them outside the model. Use idempotency where retries could repeat a paid action. Reject requests before expensive preprocessing when authorization or size checks fail.

The OWASP Agentic AI Top 10 guide provides broader context for agent loops, tool use, and authority. Budget controls should be attached to the same identity and task trace used for security decisions.

Detection and response

Alert on cost velocity, token volume, step count, retry rate, tool mix, and sudden changes by tenant or credential. A monthly budget alarm is too slow for an automated loop. Response should be able to pause a route, revoke a key, reduce concurrency, switch to a cheaper safe mode, or stop an agent while preserving the trace.

AWS documents cost anomaly detection for cloud spend. AI teams also need application-level signals that identify which task and control path created the cost.

Denial of wallet versus a busy legitimate workload

A traffic spike may be valuable, abusive, or caused by a software defect. Keep user, tenant, task, agent, and tool attribution so the response can be selective. Compare accepted business events with model and tool consumption. A large bill without that link is difficult to investigate and easy to repeat.

The prompt injection path can cause excessive actions when untrusted content changes a plan, but many denial-of-wallet incidents are simple missing limits. Inspect an agent control path when repeated actions should have been stopped by step, identity, or budget policy.

A simple test case

Create a sandbox task that would normally take two model calls and one tool call. Inject a retryable tool error, then confirm the workflow stops at the configured retry and step limits. Run a second case with an oversized input and confirm it is rejected before retrieval, embedding, or model processing creates material cost. Finally, verify that the alert identifies the tenant, task, credential, model, and tool responsible for the spend.

The expected outcome is not merely a notification. The task should enter a controlled stopped state, retain enough evidence for review, and leave unrelated tenants able to work inside their own limits.

Use layered budgets rather than one account-wide ceiling. A per-request cap limits oversized inputs, a per-task cap stops loops, a per-identity cap contains an abused credential, and a tenant or daily cap protects the wider service. Define which limit wins when several are reached and what response the caller receives. Reserve a small amount of capacity for investigation and recovery so operators can inspect the event without reopening normal traffic. Test budget resets and concurrent requests; otherwise several workers may each believe the same remaining allowance is available.