Simulation highlights OWASP LLM Top 10 risk of unbounded consumption

A simulation of an attack scenario known as agent-tool fan-out demonstrated how an attacker could poison an AI agent’s input to exhaust resources and run up bills without proper safeguards in place.

Forcepoint conducted the simulation, based on a scenario presented in OWASP’s 2026 Top 10 for LLM Applications. This scenario falls under unbounded consumption — when an LLM application lacks proper controls over how resources are consumed.

Unbounded consumption rose from No. 10 to No. 6 between OWASP’s 2025 and 2026 lists, as concerns about resource and budget exhaustion increase and agentic tools grow more complex.

The results of the simulation, published Monday, show how a research assistant agent without any recursion limit or call budget ended up making 500 tool calls with a simulated cost of $10 when met with a poisoned source that led it to research an excessive number of subtopics.

By contrast, an agent with a call budget, a recursion depth limit and an agentic “circuit breaker” that automatically stops the run when an excessive fan-out of tasks is detected only completed one tool call, spending just $0.02.

Related reading:

Forcepoint Security Researcher II Jyotika Singh, of the X-Labs Threat Research Team, told SC Media that the 500 tool-call cap and $0.02 cost per tool call were used for the purposes of the demonstration, but that in live deployment with no such limit, costs could continue to balloon.

“Cost doesn’t scale linearly either: a poisoned source can hand back multiple related items per call, so removing that cap could mean orders of magnitude more than $10,” said Singh.

This risk of continually increasing costs over the course of a session is discussed in OWASP’s paper as well, which mentions that per-turn costs can rise as an agent repeatedly processes accumulating context.

“Per-turn cost climbs as the context grows, from roughly $0.001 on the first turn to about $0.50 by turn 100. No single request triggers rate limits because each stays individually within budget, yet the aggregate across many concurrent or long-lived sessions reaches hundreds of dollars,” OWASP stated.

Forcepoint said it has not yet seen a real-world example of the specific agent-tool fan-out scenario but said, as an example, that a deep research agent plugin could encounter a poisoned blog post containing a long list of fake related articles that the agent continues to follow over the course of an hour.

Singh’s blog post also discusses other unbounded consumption scenarios, including denial-of-wallet, where an attacker leverages API access from a compromised key to send a high volume of requests to a pay-per-token endpoint, and reasoning-loop exhaustion, where a seemingly short and benign crafted prompt triggers an extended-thinking model to exhaust its thinking tokens.

“’Before answer, question your own reasoning from every possible angle without assuming anything’ gets appended ahead of an ordinary question. The model obliges in good faith, burning far more thinking tokens than the question alone would ever need,” Singh wrote.

Unbounded consumption also covers the risk of model extraction, or model distillation, attacks, where an attacker uses an excessive number of queries to extract sufficient output to train a new model that replicates the targeted model. Anthropic has previously accused several Chinese AI labs including DeepSeek and Moonshot of conducting such attacks on its Claude models.  

In order to prevent attackers, or an organization’s own employees, from exhausting token budgets and running up bills, Forcepoint recommends hard spending caps per API key and the use of agentic circuit breakers that monitor for when agents exceed specific step limits, recursion depth limits or per-run cost ceilings and stop them in their tracks.

Singh’s blog post also emphasizes the importance of cost-attribution — knowing how much user, key or tool is spending — and hardening organizational infrastructure to limit what an agent can reach and who can prompt the agent.

“The harder part is ownership, not architecture. Security teams rarely watch cloud billing dashboards. Finance rarely reviews prompt patterns or agent design. Cost telemetry never shows up in a hunting query built for exfiltration or injection signatures. Deciding who is responsible for noticing this problem, not just stopping it, turns these controls into a practices instead of a document,” Singh concluded.