LLM10 unbounded consumption: a checklist for engineering leads

Unbounded consumption means your LLM app lets users or agents run more inference than you planned, which can cause outages, surprise bills and model theft. Put limits on input size, request rate, spend and tool use, log usage per caller, and alert on spikes.

What does OWASP mean by unbounded consumption?

OWASP LLM10:2025 describes an application that allows excessive, uncontrolled inferences. The listed outcomes are denial of service, economic loss, model theft and service degradation. The page points out that the compute cost of language models, especially in the cloud, makes them an attractive target for resource abuse.

The page names concrete patterns. A variable-length input flood. Denial of wallet, where high volumes of operations exploit pay-per-use pricing. Continuous input overflow past the context window. Resource-intensive queries. Model extraction through the API. Functional replication, where outputs train a copy. Side-channel leakage of model details.

Where does the exposure sit?

Think in three layers.

• The edge. Anonymous or free-tier endpoints, public demos, and any route without authentication. This is where floods and wallet draining begin.
• The app. Features that fan out: one user request that triggers many model calls, retries, or an agent loop with no step limit.
• The platform. Shared keys, no per-team budgets, and model registries that anyone can read.

The OWASP list covers all three. Your job as a lead is to see that each layer has an owner and a number attached.

What limits belong on the checklist?

Take the mitigations from the OWASP page and attach a value and an owner to each one.

1. Input size limits. Pick a maximum for prompt and attachment size.
2. Rate limits and quotas per source, user or API key.
3. Per-request and per-user resource caps, monitored dynamically.
4. Timeouts and throttling on expensive operations.
5. A cap on queued and total actions, so an agent cannot loop forever.
6. Restricted exposure of logits and logprobs in API responses, which OWASP lists as a defense against extraction.
7. Sandboxing of the model's access to networks, internal services and APIs.
8. Comprehensive logging, monitoring and anomaly detection on usage.
9. Graceful degradation: the app should lose features before it loses availability.
10. RBAC and least privilege on model repositories and training environments, plus a centralized inventory of production models.

OWASP also lists watermarking, adversarial robustness training and glitch token filtering. Those are worth discussing with your ML team, but they are secondary to the basic limits above.

How do you tell if it is working?

Run a drill. In a staging environment, send a large volume of valid requests from one test identity and watch what happens. Does the rate limiter trigger? Does a budget alert fire? Does anyone get paged? If nothing happens, the limit exists on paper only.

Check the billing side too. A per-day spend ceiling at your provider account is a limit that works even when application code fails. Whether your provider offers such a control depends on the provider, so confirm it in their documentation.

What do people forget?

Agents. A loop that calls a model, reads the result and calls it again can burn money with no malicious user at all. Give every agent run a step budget and a token budget, and log when it hits them.

Retries are the second one. A client that retries on timeout, behind a gateway that also retries, multiplies traffic during an incident, which is exactly when capacity is low.

What to do

1. List every endpoint that reaches a model and mark which are unauthenticated.
2. Set input size, rate and quota limits and write the values down.
3. Add step and token budgets to every agent workflow.
4. Log usage per caller and alert on deviations from normal.
5. Restrict logits and logprobs unless a customer needs them.
6. Keep an inventory of production models with access control.
7. Run a load drill each quarter and record what fired.

Quick check

Sources

• OWASP GenAI: LLM10:2025 Unbounded Consumption

Last reviewed: 18 October 2026.