OWASP LLM10:2025 – Unbounded Consumption: When AI Overloads Systems

Most people think of language models as “just” text generators. LLMs can do far more than complete sentences when integrated into applications, chatbots, or autonomous agents. They can launch processes and consume APIs. They can also write files and interact with systems.

Now imagine if an LLM doesn’t know when to stop.

That’s exactly what OWASP LLM10:2025 – Unbounded Consumption warns us about. AI systems may consume too many resources. They might execute infinite tasks or trigger downstream overload without constraints or guardrails.

What is Unbounded Consumption?

Unbounded consumption happens when a model’s output or behavior leads to:

• Excessive API calls
• Unlimited memory usage
• Endless loops or task chains
• Overloaded databases or services
• Unexpected cloud costs

This isn't just inefficient—it can lead to denial of service, application crashes, or even financial damage.

Real-World Scenarios

• Prompt loops: A chatbot is asked to "explain until the user says stop"—and keeps generating massive output forever.
• Code generators: An LLM creates a recursive function that crashes the runtime when executed.
• API overuse: A model-powered assistant makes hundreds of backend calls for a single query.
• Infinite agent chaining: A self-reflecting AI tool spawns sub-agents recursively and overloads the system.

Why This Happens

LLMs don’t have a native understanding of:

• Execution cost
• Compute limits
• Quotas
• Resource prioritization

They respond to prompts with text—but that text can drive automation, and if not checked, automation can break systems.

How to Prevent It

1. Rate Limiting & Timeouts

Set strict limits on:

• Output length
• API call frequency
• Model execution duration

2. Token Budgeting

Use token counters to prevent overly long or recursive generation cycles. Most AI providers offer token tracking via APIs.

3. Function Call Limits

If your LLM can trigger tools or agents, limit how many functions it can call in one response or session.

4. Output Guards

Sanitize outputs to look for looped patterns, code that self-calls, or signs of automation abuse.

5. Audit Logs & Quota Monitoring

Monitor logs for:

• Sudden usage spikes
• Repeated queries
• Reentrant behavior

Set alerts for when consumption nears budget limits.

Related OWASP Risks

Unbounded consumption often results from or leads to:

• LLM06: Excessive Agency – AI acting on its own too much
• LLM01: Prompt Injection – users tricking AI into recursive behavior
• LLM03: Supply Chain – lack of safety checks in third-party plugins or extensions

Conclusion

LLMs aren't just writing tools—they're automation engines. And like any engine, they need a throttle.
OWASP LLM10:2025 reminds us that without limits, helpful AI can turn into a resource-devouring threat.

Designing AI systems responsibly means planning for when the model does too much—not just when it does too little.