LLM Denial-of-Wallet: Token Billing Is an Adversarial Primitive

Your API gateway logged zero errors. Uptime: 100%. Users reported nothing. Then the invoice arrived: $83,000. Your normal bill is $400.

Every AI product with a public API and token-based billing carries a financial attack surface. The pay-per-request model is structurally exploitable. Attackers force victim API costs to spike without any infrastructure attack, by crafting inputs that trigger expensive completions. The correct defense is architectural, not prompt-based.

Denial-of-Wallet Is Not Denial-of-Service

Traditional DoS exhausts server capacity: the service goes down, alerts fire, someone gets paged. DoW is different: each request is legitimate, processed correctly, and billed accurately to the operator's account.

The product appears fully operational while costs spiral. No error rates, no latency spikes, no alerts until credit exhaustion. OWASP recognized this distinction by elevating the risk from "Model DoS" (LLM04:2023) to "Unbounded Consumption" (LLM10:2025). The 2025 edition formally classifies Denial-of-Wallet as an economic damage vector distinct from availability attacks.

Four Billing Dimensions, Four Attack Primitives

Every DoW attack targets one of four billing dimensions: output token count, input token count, reasoning compute, or tool invocation count.

Output amplification: prompts eliciting maximum-length responses, billed per output token. Input saturation: filling context windows with maximum-size inputs; at $2.50-5/M input tokens and 200K+ windows, a single submission costs $0.50-1.00 before any model response. Reasoning exploitation: adversarial inputs triggering disproportionate chain-of-thought on CoT and o1 models. Reasoning tokens are billed separately at premium rates and never returned to the user.

Sponge attacks (Shumailov et al., arXiv:2006.03463, IEEE EuroS&P 2021) are the foundational class. They are adversarial inputs designed to maximize energy consumption and inference latency in neural networks, now generalized to LLM cost amplification.

Reasoning Models Introduced a Billing Dimension That Scales With Cognitive Difficulty

o1 and o3 models bill reasoning tokens separately, at premium rates. Attackers who learn to trigger unnecessary reasoning chains achieve 46x to 100x cost amplification per request, without violating any content policy.

OverThink (arXiv:2502.02542, February 2025) demonstrated the mechanism. Embedding decoy reasoning problems (Markov decision processes, Sudoku) into content consumed by RAG pipelines forces o1, o1-mini, o3-mini, and DeepSeek R1 into extended chain-of-thought. Up to 46x slowdown, transferable across models; individual decoys are benign and evade safety filters.

ThinkTrap (arXiv:2512.07086, December 2024) went further via derivative-free optimization: 100x+ amplification per request. At $15/M reasoning tokens, a single ThinkTrap request costs $1.50 versus $0.015 baseline. OpenAI exposes max_completion_tokens, but the reasoning token budget requires explicit operator configuration; without it, the default state is uncapped.

Agentic Systems Multiply the Attack Surface by Tool Count

When an LLM controls tools through MCP or similar frameworks, a single malicious tool response can cascade into thousands of downstream LLM calls.

Beyond Max Tokens (arXiv:2601.10955, January 2026) documented the attack. A malicious MCP server edits text-visible fields while function signatures remain valid. Monte Carlo Tree Search optimization achieved trajectories of 60K+ tokens with 658x cost amplification. Energy increased 100x to 560x, and GPU KV-cache hit 35-74%, all undetected by standard monitors.

The critical point: rate limiting measures access frequency, not work performed after entry. A single request triggering 200 tool calls counts as one request at the rate limiter.

LLMjacking Proves the Financial Stakes

Attackers who steal API keys instead of crafting adversarial prompts push DoW impact to $46,000 per day. The gap between first exploit and operator awareness is measured in days, not minutes.

The Sysdig report from May 2024 documented the pattern. CVE-2021-3129 (Laravel RCE) was exploited to steal AWS credentials, access the Bedrock InvokeModel API, and validate against 10 providers. Attackers disabled logging and ran a reverse proxy to resell access without exposing credentials. Estimated financial exposure: $46,000 per day per victim.

A startup's $400/month OpenAI bill became $67,000 after their key appeared in a public GitHub repo for 11 days. Operation Bizarre Bazaar (CSA, 2026) recorded 35,000+ attack sessions in 40 days, with victim costs exceeding $100,000 per day targeting Claude Opus-class models.

Validate What You Will Pay For Before You Pay For It

The correct defense model for DoW is input validation, not rate limiting. Every parameter that affects compute cost must be treated as untrusted user input and bounded before expensive processing begins.

Layer 1 — Hard output token cap: enforce max_tokens at the API call layer, not as a user-configurable parameter. A 4K hard cap prevents output amplification regardless of prompt content.

Layer 2 — Input size validation: reject or truncate inputs above a per-request threshold before routing to the model. At $5/M input tokens, a 200K-token submission costs $1.00 before any model response.

Layer 3 — Reasoning budget: for o1/o3 models, set max_completion_tokens explicitly. The default uncapped state is an open attack surface.

Layer 4 — Tool call depth limits: enforce max_steps, max_tool_calls, and max_recursion_depth in all agentic frameworks. Add circuit breakers on retry loops.

Layer 5 — Real-time spend monitoring: per-user cost tracking with alert thresholds. The MAGO Intel tool (intel.mago.team) tracks per-session token consumption patterns and flags accounts where output token ratios exceed baseline by 3x or more. This catches denial-of-wallet campaigns before billing thresholds are breached.

Layer 6 — Complexity-based routing: classify inputs with a cheap model (~$0.0001/request) before routing to expensive models. Reject or throttle inputs matching known amplification patterns.

The billing model that makes LLM APIs commercially viable is the same model that makes them financially exploitable. Operators who treat token consumption as an observability problem discover the attack through their invoice. The fix is architectural: validate what you will pay for before you pay for it, and treat every token-affecting parameter as untrusted input.