No Per-Request Resource Limits

Requests can use unlimited context, output tokens, tool calls, or wall-clock time, and spend is not tracked per caller.

Impact

A single caller can consume capacity and budget meant for everyone.

Why this severity

Impact Medium × Likelihood Medium = Medium

Impact medium: enables cost and availability attacks. Likelihood medium: SDK defaults rarely set budgets, but abuse needs access to the endpoint.

Impact Medium: Limited or recoverable harm: cost, availability, reputational damage, or exposure confined to one session or user.
Likelihood Medium: Publicly demonstrated against real products or in peer-reviewed research, or seen in the wild only with a prior foothold such as stolen credentials.

Method: OWASP Risk Rating Methodology

Evidence

Incident: LLM Jacking (MITRE ATLAS case study AML.CS0030, 2024)

Exploited by

Denial of Wallet & Resource Exhaustion Threat · Medium severity

Mitigated by

Resource Budgets, Timeouts & Graceful Degradation Guardrail · Fixes medium risks

Remediation

Set max input tokens, max output tokens, and timeouts on every call.
Meter spend per key, user, and tenant.
Limit queued and concurrent actions per session.

How to verify

Requests over the limit are rejected with a clear error.
Dashboards show per-tenant spend with anomaly alerts.

Pattern

llm.create({ input, max_tokens: 1024, timeout_ms: 20000 });
meter.charge(tenant, usage.total_tokens);

Framework mapping

OWASP Top 10 for LLM Applications 2025

LLM10:2025 Unbounded Consumption

MITRE ATLAS

AML.T0034 Cost Harvesting

NIST AI RMF 1.0

MEASURE 2.4 AI system functionality and behavior are monitored in production