Loading...
Token Budget Depletion Attack
TBDAManipulating an agent to consume excessive tokens through verbose outputs, repeated operations, or unnecessary processing, depleting token budgets and causing cost overruns or service interruption.
Example Scenario
Asking an agent to "provide extremely detailed explanations with examples for every single step" for a complex multi-step task, causing it to generate tens of thousands of tokens per response and quickly exhaust allocated token budgets.
Testing Objectives
- Test token budget enforcement
- Assess cost controls
- Evaluate output limiting
- Validate usage monitoring
Defensive Strategies
- Token budget limits per request
- Output length restrictions
- Cost threshold alerts
- Usage monitoring and quotas
- Verbosity detection and limiting
Key Features
- Token consumption maximization
- Verbose output exploitation
- Repeated operation triggering
- Budget exhaustion
Use Cases
- Token budget testing
- Cost control validation
- Output verbosity assessment
- Usage limit enforcement evaluation
Tools & Frameworks
Security Risks
Ethical Guidelines
- •Test only with budget safeguards
- •Never deplete production budgets
- •Report cost vulnerabilities responsibly
- •Focus on improving cost controls
- •Consider financial impact
Remember: This information is for educational and defensive security purposes only. Always ensure you have proper authorization before testing any techniques.
From the engineer behind this catalog
Get your agent system red-teamed
The attacks documented here work on production agent systems every day. Have yours tested before someone else does: prompt injection, jailbreaks, tool misuse and data exfiltration, with every finding written up next to its fix.
€750 instead of €1,500, one week, written report and walkthrough call, until 30 September