How to Identify LLM Denial of Service Vulnerabilities in 2026 | AI LLM Hacking Course Day 33 of 90

📰 Originally published on Securityelites — AI Red Team Education — the canonical, fully-updated version of this article.

🤖 AI/LLM HACKING COURSE

FREE

Part of the AI/LLM Hacking Course — 90 Days

Day 33 of 90 · 36.7% complete

⚠️ Authorised Targets Only: LLM Denial of Service testing can produce real financial impact — excessive API bills, degraded service, and in extreme cases, complete service outage. Always get explicit written approval for DoS testing before running any resource exhaustion or cost amplification tests. Many engagements exclude DoS testing entirely or restrict it to staging environments.

A client called me on a Tuesday afternoon with a problem I wish more teams tested before going to production: their AI customer-service system was effectively down.

It hadn’t crashed. The servers were running. The API was responding.

The problem was the bill.

At 11 a.m., just six days into the billing cycle, their AI API budget hit its monthly hard cap. From that moment on, legitimate requests started receiving 429 Too Many Requests responses.

Thirty-five thousand customer queries went unanswered that day.

And while their customers waited, competitors’ live-chat systems were happily picking up the traffic.

The attack had started at 6 a.m.

For five hours, an attacker had been sending sustained requests to the AI API. The prompts weren’t complicated. They were simply expensive:

“Write a complete, detailed explanation of every feature of the product, with examples, for a customer who has never used software before.”

Each request encouraged a massive response—around 4,000 tokens. The attacker ran the requests concurrently, turning a relatively cheap source of traffic into an expensive workload for the victim.

That’s the uncomfortable part of LLM denial of service: the attacker doesn’t always need to overwhelm your servers. They can overwhelm your budget.

Imagine the economics. The attacker may spend only a few dollars—or potentially much less—generating requests from inexpensive infrastructure or compromised resources. The victim, meanwhile, pays for every token processed, every expensive model invocation, and every downstream operation those requests trigger.

That’s cost amplification.

And the basic defenses aren’t exotic.

– Set maximum output-token limits. – Enforce per-user and per-IP rate limits. – Validate input length. – Apply quotas and concurrency limits. – Monitor abnormal token consumption. – Put hard spending controls around expensive model routes.

Most importantly, ask the question that teams often forget during development:

“What happens if someone deliberately tries to exhaust our AI API budget?”

That’s the question we’re going to answer in Day 33.

🎯 What You’ll Master in Day 33

Map the cost model of an AI deployment to identify DoS attack vectors
Test context window limits and input length validation
Craft maximum-output requests to test output length controls
Test rate limit enforcement at application and gateway layers
Calculate cost amplification ratios to quantify DoS feasibility
Test downstream resource multiplication from AI-triggered actions

⏱️ Day 33 · 3 exercises · Think Like Hacker + Kali Terminal + Kali Terminal ### ✅ Prerequisites - Day 14 — LLM10 Unbounded Consumption — the OWASP overview from Day 14 is the conceptual foundation; Day 33 is the full assessment methodology with exploitation techniques and cost modelling - Engagement scope that explicitly authorises DoS testing — never run resource exhaustion or cost amplification tests without written approval - Python with asyncio — Exercise 2 builds the concurrent request tester ### 📋 LLM Denial of Service — Day 33 Contents 1. Mapping the AI Cost Model 2. Context Window Exhaustion 3. Output Length Amplification 4. Rate Limit Bypass Techniques 5. Cost Amplification Ratio Calculation 6. Downstream Resource Multiplication In Day 32 you assessed how a model’s value can be extracted through API queries. Day 33 covers how that same API surface can be used to destroy the model’s ability to serve legitimate users. Day 34 moves to the multimodal attack surface — the new vulnerabilities that appear when AI systems process images, audio, and documents alongside text.

Mapping the AI Cost Model

LLM DoS is primarily a financial attack. Traditional DoS targets CPU and bandwidth — resources that are hard limits. LLM DoS targets token budgets — soft limits that can be exhausted before hardware approaches saturation. The cost model determines which attack vector produces the highest financial damage per unit of attacker effort. A deployment with generous per-token pricing and no output limits is the highest-risk configuration. A deployment with hard max_tokens per request, per-user rate limits, and budget alerts is much more resistant.

Input tokens and output tokens typically have different prices, with output tokens costing significantly more than input tokens in most commercial APIs. This price differential is directly relevant to the attack strategy: forcing maximum-length outputs produces more financial damage per request than flooding with maximum-length inputs. The ideal DoS payload from a cost amplification perspective is the shortest possible input that reliably triggers the longest possible output.

🧠 EXERCISE 1 — THINK LIKE A HACKER (20 MIN · NO TOOLS)
Design the Optimal DoS Attack for Three Different AI Billing Models

⏱️ 20 minutes · No tools needed

The optimal DoS attack is specific to the target’s cost model. This exercise designs the highest-damage attack for three different billing configurations, then calculates the cost amplification ratio for each.

---

📖 Read the complete guide on Securityelites — AI Red Team Education

This article continues with deeper technical detail, screenshots, code samples, and an interactive lab walk-through. Read the full article on Securityelites — AI Red Team Education →

---

This article was originally written and published by the Securityelites — AI Red Team Education team. For more cybersecurity tutorials, ethical hacking guides, and CTF walk-throughs, visit Securityelites — AI Red Team Education.