LLM10:2025: Unbounded Consumption
Token, API-credit, or compute exhaustion attacks. Attackers force the model to do expensive inference, drain quota, or enable wallet-attack via long contexts and recursive agent calls.
How it's found
Found by driving long-context and recursive agent-loop requests to test for missing token, compute, and cost budget controls.
Standards mapping
Where this fits in a TurboPentest engagement
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Frequently asked questions
What is LLM10:2025 Unbounded Consumption?
Token, API-credit, or compute exhaustion attacks. Attackers force the model to do expensive inference, drain quota, or enable wallet-attack via long contexts and recursive agent calls.
How do you find Unbounded Consumption?
Found by driving long-context and recursive agent-loop requests to test for missing token, compute, and cost budget controls.
Which CWEs map to LLM10:2025?
LLM10:2025 maps to CWE-770, CWE-400.
Does TurboPentest test for Unbounded Consumption?
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Related OWASP categories
- OWASP Top 10 for LLM ApplicationsLLM01:2025: Prompt Injection
- OWASP Top 10 for LLM ApplicationsLLM02:2025: Sensitive Information Disclosure
- OWASP Top 10 for LLM ApplicationsLLM03:2025: Supply Chain
- OWASP Top 10 for LLM ApplicationsLLM04:2025: Data and Model Poisoning
- OWASP Top 10 for LLM ApplicationsLLM05:2025: Improper Output Handling
- OWASP Top 10 for LLM ApplicationsLLM06:2025: Excessive Agency
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a $99 pentest