What Is Denial of Wallet / Service?
An attacker who can trigger excessive engagement with an LLM-based application, directly or through a jailbroken interface, can degrade service for legitimate users or run up a significant bill. In agentic systems, where a single triggered task can spawn many downstream model calls, the potential blast radius of this kind of abuse has grown substantially.
How It Works
- An attacker gains access to an application's LLM interface, sometimes bypassing a poorly implemented rate limit, and drives up usage.
- Costs scale directly with usage in most LLM pricing models, so an attacker doesn't need to break anything, just make the target's own infrastructure expensive to keep running.
- In agentic systems, a single malicious trigger can fan out into many model calls automatically, multiplying the cost or resource impact of one initial action.
