To test for unbounded consumption, check that every request has a ceiling: input size, output length, time, rate, spend and queue depth. Then confirm that you get an alert when usage spikes and that the app degrades gracefully. OWASP LLM10 covers excessive inference that causes outages, runaway cost and model theft.
What does OWASP include in LLM10?
OWASP defines unbounded consumption as an LLM application letting users run excessive or uncontrolled inferences, which can lead to denial of service, economic losses, model theft and service degradation. Because inference is computationally expensive, especially in the cloud, it is easy to exploit.
Its list of examples includes flooding the model with variable length inputs, "denial of wallet" where high volumes of operations drive up pay per use costs, repeated inputs that exceed the context window, resource heavy queries, and model extraction or replication through the API. This plan covers the first four. Model extraction is mostly a monitoring and access question.
No attack scripts here. The tests below use your own staging environment and ordinary load tools.
Test 1: input limits
Send inputs near, at and above your intended maximum length, in a staging environment. Expected result: oversize input is rejected quickly and cheaply, before it reaches the model. OWASP's first mitigation is to enforce reasonable input size limits.
Test 2: output limits
Check the maximum tokens you allow per answer and per conversation. OWASP also suggests restricting or obscuring detailed output such as logit bias and logprobs in API responses if you expose them.
Test 3: rate limits and quotas
Run a load test from one account, one key and one IP address, and confirm that caps apply per source over time. OWASP recommends rate limiting and quotas. Test the unhappy edges: many small accounts, a leaked key and a free tier user.
Test 4: cost ceilings
This is the denial of wallet test. Set a low spend alert and a hard cap in staging, then drive load and see whether the cap stops spend. Ask who gets the alert, how fast, and who can turn traffic off.
Test 5: expensive queries and timeouts
Find your most expensive legitimate request, such as long documents with tool loops. Confirm timeouts and throttling bound the duration, as OWASP recommends. If your agent can call itself or chain tools, check that a depth or step cap exists.
Test 6: queue and degradation behavior
OWASP suggests capping queued and total actions and scaling with load balancing. Under overload, does the system fail one tenant or everyone? Graceful degradation means keeping partial service instead of failing completely.
Test 7: sandbox and access
OWASP suggests sandboxing the model's access to networks, internal services and APIs, and applying role based access and least privilege to model repositories and training environments. Check that a runaway agent cannot reach internal systems it should not.
Test 8: logging and anomaly detection
Spike usage in staging and confirm an alert fires. OWASP recommends logging, monitoring and anomaly detection on resource use.
How to score results
For each test record: limit exists, limit enforced, alert fires, owner named. Any "no" is a finding. A simple sheet is enough.
Where Safeguard fits
If your agents use Safeguard through the MCP server, tool calls to Safeguard are unlimited on every plan, so your own agent loop limits matter more than a provider cap. Safeguard supports Full AI, Zero AI or your own model, which lets you decide where inference cost sits. Controls for your own LLM application remain yours to build.
What to do
- List each endpoint that triggers inference.
- Set input, output, time and step limits on each one.
- Add per account and per key rate limits and a spend cap.
- Alert on usage spikes and name who responds.
- Run the eight tests above before each major release.
- Keep an inventory of production models, as OWASP suggests.
Quick check
What is denial of wallet?
It is running high volumes of operations to drive up costs under pay per use pricing, one of the examples in OWASP LLM10.
Is rate limiting enough?
No. Pair it with input and output limits, timeouts, spend caps, sandboxing and monitoring, since one request can be expensive on its own.
Sources
- OWASP GenAI: LLM10 Unbounded Consumption, fetched 18 October 2026
Last reviewed: 18 October 2026.
