Hunt Agent Resource Abuse (Denial-of-Wallet / Unbounded Consumption)

Agents cost money per token and hold real compute. If a cheap request can force expensive generation, an unbounded loop, or a costly downstream call — and nothing caps it — you have denial-of-wallet (a billing attack) and/or denial-of-service (availability). The finding is a measured cost/resource impact with an amplification ratio (1 request → N calls / $X / T seconds), not a vibe that it was slow.

Where This Lives / Attack Surface Signals

Any metered/paid LLM agent; autonomous loops (plan→act→reflect with no depth cap); multi-agent fan-out (one agent spawns many); agents with paid downstream tools (image gen, code exec, external APIs, large DB scans); shared-tenant quota (one org budget for all users). Signals: no visible output cap, agent re-invoking tools repeatedly, retrieval of large docs, "I'll keep trying until…".

Crown Jewel Targets

• Cross-tenant availability: exhaust a shared org quota / rate limit so other users are denied.
• Runaway loop: a self-referential or agent-calls-agent loop with no depth/budget cap → unbounded cost from a single request.

Characterize First

1. Is it metered? Per-token billing, a paid API tier, or a hard quota? (denial-of-wallet needs a meter).
2. Output/token caps — is there a max_tokens / max output length? Force a huge generation (long list, repeat-N, verbose format) and measure.
3. Loop/recursion caps — can you induce a loop (agent calls a tool that feeds itself, or two agents that call each other)? Is there a depth/step limit?
4. Downstream cost — which tools cost real money/compute (paid APIs, image/code gen, unbounded DB scan, large retrieval)?
5. Rate limit / budget — per-user or shared? Enforced where — gateway, app, or nowhere?