Definition
Plain language
An attack that doesn't crash a system but quietly runs up its compute bill until it's unaffordable.
As stated in the literature
An attack class against pay-per-call AI services in which adversaries induce legitimate-looking but expensive activity, exhausting budgets without tripping traditional denial-of-service detectors.
Why it matters: Cost, not availability, is the soft underbelly of LLM-based services, and standard DDoS defenses don't see it coming.
For example, an attacker crafts inputs that make an AI-powered customer support endpoint emit 30,000-token responses to every query, racking up cloud bills until the service is shut off.
Heard on the show
“There's a real-world pattern here that maps to a category called denial-of-wallet.”Episode 030 — Why Your AI Agent Won't Stop Working — and Each Model Falls for a Different Trap