Unbounded Consumption

The application allows excessive or uncontrolled resource usage — inference calls, token volume, tool invocations — enabling denial-of-service, runaway cost, or model-extraction abuse. In a multi-agent system: A group of agents autonomously re-queries each other in a retry loop after a transient tool failure, multiplying one failed call into a cost spike bef…

Use this profile to understand the building block briefly, place it in the model, and switch to the 360° assessment when needed.

Content type

Concept

Theoretical construct: explains a term, principle, or mental model.

Classification level

Structure

What organizes, connects, or makes decisions possible.

Available perspectives

Open this building block directly in an already curated view.

360°

In brief

Unbounded Consumption in brief

Unbounded Consumption describes a service that consumes resources without effective limits, putting cost, availability, or stability at risk.

Where does it come from?

The term was established in a security context for systems whose resource use can run out of control because limits are missing. OWASP discusses the risk for APIs and generative AI applications; its line of development runs from classic resource exhaustion to exploitable cost and consumption loops.

The mental model

Limit every costly or finite resource: inputs, runtime, concurrency, data volume, and budget. Monitor usage and stop operations safely before one request overloads the system.

Key building blocks

Core idea

Unbounded Consumption turns missing usage limits into a security and operations risk.

Mechanism

Unbounded or poorly monitored use consumes resources until cost, availability, or stability suffers.

Practice context

Apply limits, quotas, timeouts, and monitoring wherever users or processes request resources.

When is it useful?

The pattern matters for APIs, AI services, and background jobs when one request could consume a disproportionate share of resources.

OWASP Unbounded Consumption OWASP LLM102: Unbounded Consumption Unbounded Consumption

Why is this building block relevant?

The application allows excessive or uncontrolled resource usage — inference calls, token volume, tool invocations — enabling denial-of-service, runaway cost, or model-extraction abuse.