What Is Cloud Cost, Really?
Before we get into the attack vector, let's ground the conversation. Cloud cost is the total spend you rack up running workloads on shared or dedicated infrastructure—compute, storage, networking, and increasingly GPU time. For teams running large language models in production, that bill has a peculiar property: it scales with demand in ways traditional SaaS never did. A single API call can cost fractions of a cent or several dollars depending on token volume, model size, and how many downstream calls that one request fans out to.
When someone asks how much does an LLM cost, the honest answer is "it depends on who's prompting it." Under normal load, a well-tuned inference pipeline keeps per-request costs predictable. Under adversarial load, that predictability evaporates.
Unbounded Consumption: OWASP LLM06 Explained
The OWASP Top 10 for LLM Applications, first published in 2023 and updated for 2025, catalogues the security risks specific to AI-powered applications. As LLMs embed more deeply into everything from customer support to internal operations, the community has watched the threat surface widen alongside adoption. Unbounded consumption sits at position six. It covers scenarios where an attacker forces an LLM application to consume disproportionate resources—compute, memory, API quota, or downstream tool invocations—by crafting inputs that trigger expensive processing paths.
This isn't theoretical. The F5 security team documents how bots and automated systems interact heavily with LLM applications, creating attack vectors that exploit resource boundaries the application never intended to expose. An adversary doesn't need to break your model. They just need to make it think very hard, very many times, very fast.
How an LLM Cost Breakdown Dismantles Under Attack
A healthy LLM cost analysis looks something like this: input tokens, output tokens, embedding operations, retrieval calls, and occasional multi-step agent invocations all contribute their slice. You can forecast next month's spend within a reasonable band. You can allocate shared GPU cluster costs across teams using a weighted model.
Unbounded consumption shreds that model. The F5 team identifies several mechanisms that drive resource exhaustion:
Best-of-N brute force. Research by Hughes et al. shows a 89% success rate on GPT-4o and 78% on Claude 3.5 Sonnet when an attacker generates enough prompt variations systematically. Each variation is a full inference call. Hundreds or thousands of them per session multiply your per-session cost by orders of magnitude. The attacker spends compute; you pay for it.
Denial of wallet via recursive agents. When an LLM-based system runs with elevated privileges and the ability to call external functions, a crafted prompt can trigger cascading invocations. F5's writeup on excessive agency describes how adversaries use automation to fire multiple prompts hoping to trigger a chain reaction—each hop in that chain billing against your infrastructure.
Typoglycemia and token-padding attacks. Inputs where only the first and last letters of each word remain correct still parse correctly in LLMs but can inflate token counts or confuse tokenizers, pushing requests into more expensive processing tiers.
The net effect on your LLM cost breakdown: a handful of malicious sessions can consume more budget than thousands of legitimate ones. You've been DDoS'd, except the weapon is your own inference bill.
The Power-Law Problem: Why Defenses Are Patchwork
The OWASP Cheat Sheet for LLM Prompt Injection Prevention lays out a sobering assessment of current mitigations against persistent, automated attackers:
- Rate limiting increases the computational cost for attackers but doesn't prevent eventual success.
- Content filters can be systematically defeated through sufficient variation attempts.
- Safety training is proven bypassable with enough tries across different formulations.
- Circuit breakers have been demonstrated as defeatable even in state-of-the-art implementations.
- Temperature reduction provides minimal protection even at zero.
The underlying cause is power-law scaling: the probability of finding a bypass increases predictably with each additional attempt. An attacker with patience and a script will eventually land. This means defensive engineering for unbounded consumption can't rely on a single gate. It requires architectural thinking—budget caps enforced at the platform layer, per-session compute ceilings, anomaly detection on token velocity rather than request count.
Bots at Scale: The Automation Layer
What elevates unbounded consumption from "someone found an expensive prompt" to a genuine operational threat is automation. The F5 analysis is direct: attacks that might be individually trivial become devastating at bot scale. An adversary who would need to manually test fifty variations will instead script five thousand. The automation discovers inputs that produce outputs harmful to downstream systems, then repeats the pattern across every entry point it finds.
This is why the OWASP framing matters. Placing unbounded consumption sixth on the Top 10 signals that the community sees it as more than a billing oversight. It's an integrity failure in the application's resource boundary assumptions.
Cost Allocation After the Breach
When the dust settles on an incident like this, finance teams face a question most cloud cost tooling wasn't designed to answer: which team owns the $4,200 this one bot session burned through your GPU cluster? Shared GPU cost allocation typically distributes spend by utilization weight or reservation ownership. Neither maps cleanly to an adversarial event where one anomalous session consumes resources proportional to a full product team's monthly quota.
The practical fix mirrors what we covered in our analysis of why falling model costs don't fix SaaS margins — you need unit economics that are sensitive to per-request cost variance, not just aggregate volume.
What "How Much Is an LLM" Means Under Adversarial Load
The question how much is an LLM has two answers. The list price on a model card or API pricing page—the kind of head-to-head numbers behind Databricks' open-weight AI cost picture—and the real cost, which is list price multiplied by an adversarial amplification factor you probably haven't measured yet.
If you've studied the economics of training a production model for $1,500, you know the optimization game is real—quantized weights, efficient architectures, smart batching all bend the per-inference curve downward. But those optimizations assume good-faith traffic. They assume you're trying to make legitimate queries cheaper. None of that engineering protects you when an attacker is trying to make your inferences expensive.
Practical Defenses Without a Full Rewrite
You don't need to rebuild your architecture to start limiting exposure. A layered approach addresses the most common unbounded consumption vectors:
-
Token budgets per session. Hard ceilings on cumulative tokens consumed within a session window. Not per-request—per session. This catches Best-of-N brute force where individual requests look normal but the aggregate doesn't.
-
Downstream call depth limits. If your LLM can invoke tools or chain sub-agents, cap the total fan-out per invocation. F5's excessive agency writeup shows attackers exploit unbounded privilege chains.
-
Anomaly detection on token velocity. Track not just request frequency but tokens consumed per unit time per session. A Best-of-N attack is slow by request count but fast by token throughput.
-
Remote content sanitization. The OWASP cheat sheet recommends stripping injection patterns from external content before it reaches the model, reducing the attack surface for indirect prompt injection that triggers expensive processing.
-
Separate budget pools for agent workloads. Isolate agentic pipelines that can invoke external services so a runaway loop can't drain your shared inference quota.
The Bigger Picture
Unbounded consumption is where the security conversation and the cost conversation collide. It's an OWASP-listed vulnerability, a budgeting nightmare, and a visibility gap in most cloud cost platforms that weren't built for per-token adversarial amplification.
OWASP placed it sixth on the 2025 Top 10 because it's not exotic. It's the inevitable consequence of pricing AI by the unit of computation while giving attackers an unlimited supply of inputs to experiment with. The attackers don't need to know your system prompt or exfiltrate your embeddings. They just need to make you compute harder than you planned to.
If your LLM cost analysis stops at "we spent X this month," you're measuring the symptom and missing the threat.
