Open cardosec

Case 350734 · AI security · L2 Practitioner

Unbounded Consumption and Denial of Wallet

Practise as: Explain it · InterviewLevel: L2 Practitioner

Interview questionWhat is unbounded consumption in an LLM app, and how do you stop someone running up your bill?

  1. 01 What is it?
  2. 02 How is it abused?
  3. 03 How do you stop it?
Practise this card As Interview
What a strong answer covers

Try it out loud first. Then check yourself:

  1. Every call costs compute, so floods of long prompts or huge outputs can exhaust a budget or crash the service (OWASP LLM10).
  2. Cap per-user and per-key requests and tokens, set a maximum output length, and reject oversized inputs early.
  3. Require authentication for anything expensive, and watch for one account or key using far more than the rest.
  4. Set billing alerts and hard spending limits with the provider, so a leak or a bug cannot cost unlimited money.

If the interviewer pushes back

  • Your free tier is being farmed by thousands of new accounts. Which controls still work?

Go deeper

More AI security cards

All AI security cards →

cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.

Reviewed 2026-10-09