For OWASP LLM10, Unbounded Consumption, log who called, how much each call cost in tokens and time, and what the model could reach. Alert on spend, request volume and input size per identity, on unusual query patterns, and on tool or network use. Pair every alert with a hard limit that stops the loss.
What does LLM10 cover?
OWASP's 2025 entry defines unbounded consumption as an LLM application allowing excessive and uncontrolled inference, which leads to denial of service, economic losses, model theft and service degradation. Its listed examples include variable-length input floods, denial of wallet, continuous input overflow, resource-intensive queries, model extraction through the API, functional model replication and side-channel attacks.
The thread running through them is cost with no ceiling: compute, money, or the information you leak by answering without limits. Logging is how you see the ceiling being approached. This post stays on the defensive side and gives no attack steps.
What should every request log record?
Log fields that let you answer three questions after an incident: who, how much, and what was reachable. A workable schema:
- Caller identity, tenant, API key id and source address.
- Model name and version, and the route or feature that called it.
- Input size in tokens, output size in tokens, and total cost estimate.
- Latency and whether the call timed out or was throttled.
- Count of tool calls and which tools ran.
- Network destinations the model or its tools contacted.
- Whether the request hit a quota, a rate limit or a guardrail.
Do not log raw prompts and outputs by default. They may contain personal data and secrets. Log sizes, hashes and classifications, and keep sampled content under tight access with a short retention period.
Which alerts map to OWASP's risks?
| OWASP risk | Signal to alert on |
|---|---|
| Variable-length input flood | Sudden rise in request count or average input tokens from one identity |
| Denial of wallet | Spend per identity or per day above a budget, or burn rate that would exhaust the budget |
| Continuous input overflow | Repeated inputs above the context window limit |
| Resource-intensive queries | Latency and output tokens far above the normal for that route |
| Model extraction | Very high volume of systematic queries from few accounts, or heavy use of probability outputs |
| Functional replication | Bulk generation patterns that look like dataset building |
| Side channel | Anomalous responses to filter probing, plus unusual egress |
Set baselines per customer tier, since a legitimate batch user looks different from an interactive one. Alert on change from the identity's own baseline as well as on absolute thresholds.
Which limits should sit behind the alerts?
OWASP's mitigations map onto controls you can enforce at the gateway: strict input validation and size limits, rate limiting and user quotas, dynamic resource allocation, timeouts and throttling, restricted exposure of logit_bias and logprobs, sandboxing of network and internal service access, graceful degradation, limits on queued actions, and access control with least privilege. It also lists watermarking, and central model inventory and governed deployment for production models.
An alert without a limit only tells you after the money is gone. Add a budget cap per key that cuts off traffic automatically, with a manual override for the owner.
What about agents that call tools?
Agents multiply consumption, since one user request can cause many model calls and tool runs. Count the chain: total model calls per task, total tool calls, and wall time. Put a ceiling on all three. Safeguard's MCP server has unlimited tool calls on every plan, so any cap has to come from your own agent layer. The same rule holds for any MCP server: log tool calls per identity and enforce the ceiling where the agent runs.
What are the limits of this approach?
Logging catches what you instrumented. Model extraction can look like normal use at low volume, and OWASP lists its defenses as a mix of rate limits, output restrictions and detection, not a single fix. Expect to tune.
What to do
- Add token counts and cost per request to your gateway logs.
- Set a daily and monthly budget per API key, with an automatic cutoff.
- Enforce maximum input size and a request timeout.
- Rate limit per identity, not just per IP address.
- Alert on spend burn rate, input size spikes and error ratios.
- Remove or restrict logprobs and logit controls in public APIs unless needed.
- Cap model calls, tool calls and runtime per agent task.
- Review alert thresholds monthly against real traffic.
Quick check
What is denial of wallet?
OWASP describes it as driving a high volume of operations to exploit the pay-per-use cost model of cloud AI services, causing unsustainable costs for the provider.
Should I log full prompts?
Not by default. Prompts can contain personal data and secrets. Log metadata and sample content under strict access and short retention.
Sources
Last reviewed: 18 October 2026.
