Your new AI assistant works beautifully in the demo. Then one weekend someone scripts ten thousand requests against it — and Monday starts with a cloud bill nobody budgeted for. That is unbounded consumption.
Who it’s for
Teams running chatbots, AI assistants or LLM-powered APIs
You’ll learn
- · What OWASP LLM10 covers
- · How costs and outages happen
- · The limits that prevent them
Reading time
7 min read
Why this matters to your business
AI usage is billed per request and per token. Without limits, one script or one looping agent can cost more in a weekend than your feature earns in a month — or take it offline for real customers.
What “unbounded consumption” means
Every call to a large language model costs money and computing time. Unbounded consumption is number 10 on the OWASP Top 10 for LLM Applications (2025): it covers any situation where someone can make your AI feature do far more work than you intended.
The result can be a surprise cloud bill, a slow or unavailable service for real users, or an attacker quietly copying what your model knows by asking it thousands of questions.
How it happens
Common causes are a chatbot or API with no rate limits, very large inputs that the model must read in full, prompts that trigger long or repeated outputs, and AI “agents” that can call tools in a loop without a stop condition.
Free trials and public demo pages are frequent targets, because they are easy to reach and often have the weakest limits.
Controls that stop it
Set limits at several levels: requests per user and per IP, maximum input and output length, maximum tool calls per task, and a daily spending cap with alerts. Require sign-in for expensive features, and watch usage per account so unusual spikes are noticed the same day.
The less obvious risk: model extraction
Large numbers of carefully chosen questions can be used to copy a model’s behaviour or the private knowledge behind it. Per-account limits and monitoring for unusual query patterns make this far harder and far more visible.
Key takeaways
- LLM10 is about cost, availability and model extraction.
- Public demos and free tiers are hit first.
- Limits at several levels stop runaway usage.
Jargon buster
- Token
- A small piece of text the model reads or writes; providers charge per token.
- Rate limit
- A cap on how many requests a user or IP can make in a period of time.
- Agent
- An AI setup that can call tools or other services on its own to finish a task.
What you should do
- Set per-user and per-IP request limits
- Cap input and output length
- Limit tool calls for AI agents
- Add a daily spend cap with alerts
What our team does
- Map every way your AI feature can be reached
- Test rate limits, input size and agent loops
- Show the cost and availability impact in plain terms
- Retest after your fixes
- Simulate scripted abuse safely, within agreed limits
- Check spend caps and alerts actually fire
Launching or scaling an AI feature? We’ll test how far it can be pushed before your bill or your users feel it.
— The CRIS InfoTech security team