LLM06: Unbounded Consumption · 2026

Unbounded consumption exploits cost asymmetry to cause unavailability, spending or model theft; agents and extended reasoning increase the risk.

Summary

Unbounded consumption exploits cost asymmetry to cause unavailability, spending or model theft; agents and extended reasoning increase the risk.

How the attack works

The application permits repeated generation without quotas or limits; costly requests consume the budget and block service.

Example

Vulnerable · Pseudocode

limits:
  requests_per_user: unlimited
  output_tokens: unlimited
  timeout_seconds: null

Fix: Limit requests, tokens, time and budget per identity; bound queues and stop agent loops.

Prevention

Apply limits per token, cost, user and session.
Enforce spending caps and agent step or time limits.
Detect loops and use circuit breakers.

Lineage

2025 · LLM10: Unbounded Consumption Moves up to rank 6 in 2026
2026 · LLM06: Unbounded Consumption Moves up from rank 10

2025:LLM10 → 2026:LLM06: Unbounded Consumption moves up from rank 10 to 6.

Sources

Open official source ↗

Buy me a coffee