Lab 9: Unbounded consumption

A planted loop, a fan-out and an enormous answer, priced in tokens. Find the limit that stops each one.

Local, simulated and deterministic. Fixed synthetic fixtures, fake data, mock tools; nothing is executed or sent anywhere.

1System
A tool-using agent that pays per token. A document it reads makes it repeat the same search forever, or makes every search spawn two more, or asks for an enormous answer.
2Trust boundary
Untrusted content influencing how many steps, calls and tokens the agent spends, all billed to the operator.
3Assumption
“The agent stops when the task is done.”
4Fixed synthetic fixture
Three fixed patterns (a loop, a fan-out, a huge output) and a simulated cost meter in tokens.

1What the planted document makes the agent do

60 steps · 346,500 tokensStopped by: simulation cap (60 steps): with no limits it would continue

5Failure
With no limits the loop and the fan-out both pass 346,000 tokens before the simulation's own cap stops them. Loop detection catches the loop but not the fan-out, because every call there is different.
6Root cause
No bound on steps, tool calls, output length or total spend: the agent's cost is controlled by its input.
7Impact
Denial of wallet (a large bill), denial of service for other users, and exhausted rate limits on downstream APIs.
8Defense
Hard limits on steps and tool calls per task, loop detection, a per-task token budget with a circuit breaker, and output length caps. Rate limits per user on top.
9Retest
With all limits on, the loop stops at 4,500 tokens, the fan-out at 15,000 and the huge output at 2,000, each with a clear reason.
10Residual risk
Limits set too low break legitimate long tasks. Tune them from real usage, and alert on tasks that hit a limit.
11Framework mapping
- OWASP LLM Top 10 (2026): LLM06 Unbounded Consumption
- OWASP Agentic Top 10: ASI08 Cascading Failures
- NIST AI 100-2e2025: availability breakdown
12Connection to LLM fundamentals
Generation cost grows with every token: each new token attends over the whole context (prefill once, then one decode step per token), so longer loops are not just more steps but more expensive steps.