At its IT Symposium/Xpo in Orlando in October 2026, Gartner recapped its top strategic predictions for 2027 and beyond. One of them names a risk that, in our experience, few finance and security teams have planned for: "By 2030, 80% of organizations with public-facing AI will have experienced a 'cost exhaustion attack,'" in which malicious actors deliberately drive excessive AI usage to increase operational costs.
A second prediction points toward the answer. By 2028, Gartner expects 60% of Global 500 companies to embed AI FinOps control at inference, shifting cost governance from reactive reporting to real-time optimization. In plain terms, the spending limit moves out of the finance dashboard and into the code path that calls the model, where it can stop a bad request before it is billed.
The timing is not an accident. Air Street Capital's State of AI Report 2026, drawing on Epoch AI estimates, finds that reaching a fixed benchmark score has become 47% cheaper each quarter since 2023, roughly 13-fold cheaper each year. The same report warns that this doesn't mean every company's total AI bill falls, because agents can make many model calls as they work.
A disclosure before we go further. Golabs builds custom AI agents, so we benefit when companies invest in getting the architecture right. Gartner sells advisory services; Air Street Capital invests in AI companies, Ramp sells spend-management software, and Pillar Security sells AI security. Both Gartner figures are forecasts, not measured data. We flag each source's interest where it applies.
What Is a Cost Exhaustion Attack?
A cost exhaustion attack deliberately inflates your AI's running costs. Attackers send requests, prompts, or documents designed to make your model or agent consume as many tokens, tool calls, and compute minutes as possible. The goal is a large bill, not stolen data. OWASP calls the same risk Denial of Wallet.
OWASP's Top 10 for LLM Applications lists it under LLM10:2025, Unbounded Consumption. It describes attackers who "exploit the cost-per-use model of cloud-based AI services" and warns that sustained abuse can deplete the target's financial resources. OWASP is a nonprofit, and its listing is the clearest independent sign that this is a recognized security risk, not a billing quirk.
In our experience, these attacks take three common shapes. Volume abuse floods a public endpoint with requests. Amplification uses inputs that make each request far more expensive, such as content that triggers long reasoning chains. Hijacking uses stolen or unprotected access to your models to run someone else's workload. All three show up on your invoice before they show up anywhere else.
Why Do Falling Model Prices Make the Risk Bigger?
Cheaper calls encourage more ambitious designs. Teams that once made one model call per user request now build agents that plan, retrieve, call tools, check their own work, and retry. Each step is cheap. Together they can turn one user action into dozens or hundreds of billed calls, and an attacker only has to find the input that maximizes that multiplier.
Spending is already widely spread. Using Ramp customer data from August 2026, the State of AI Report found that the median firm in the top 1% of AI spenders paid $7,205 per employee per month, compared with $12.50 for the median firm. Ramp's customers aren't the whole market, but the gap shows how far AI costs can run as usage scales.
Research shows how much a single input can amplify cost. In the OverThink paper (arXiv 2502.02542), researchers from UMass Amherst and other institutions planted decoy problems in public content that reasoning models retrieve. They observed reasoning tokens increase by up to 46 times under large-scale, context-agnostic attacks and note that reasoning tokens are billed like output tokens. Treat 46 times as a ceiling, not a typical result.
What Do These Attacks Look Like in Practice?
Unattended agents are exposed in ways chatbots aren't. In the GitInject paper (arXiv 2606.09935, June 2026), researchers from Virginia Tech and AI Security Co. targeted AI coding agents running in GitHub CI/CD workflows across four providers. A two-hour campaign cost the victim $32 to $111 and consumed 400 Actions minutes, at zero cost to the attacker.
Those numbers look small, and that is the point. The paper puts the cost at about $1.11 per attack pull request. Scale a campaign across days, repositories, or customer-facing endpoints, and you get a cost that nobody approved, and nobody notices until the invoice arrives. CI/CD agents are a useful warning because they run on triggers that nobody watches in real time.
Hijacking is already organized. Pillar Security's honeypots recorded 35,000 attack sessions between December 2025 and January 2026, roughly 972 a day, against exposed Ollama, OpenAI-compatible, and MCP endpoints. Pillar reported a marketplace reselling stolen access to more than 30 LLM providers at 40% to 60% discounts, while victims pay full price for the compute.
Where Should Your AI Spending Limits Actually Live?
In the code path, as close to the model call as possible. Alongside its FinOps prediction, Gartner recommends that organizations "implement runtime cost controls, deploy inference-path telemetry and make cost governance a core requirement of AI platforms and applications." These six controls are the ones we build into custom agents by default. None requires a new platform, only a decision to treat cost as a security property.
Give every task a budget. Set a maximum token and dollar budget per task, per user session, and per agent run, and stop the run when it is reached. A support agent that usually finishes in a handful of model calls should not be able to make hundreds. When the budget trips, the agent should fail gracefully and hand off to a person, not keep trying.
Cap loops, steps, and retries. Agents often fail in loops: a tool returns an error, the agent retries, the retry fails, and the cycle repeats. Put hard limits on planning steps, tool calls, and retries, and add timeouts at every level. OWASP lists rate limiting, timeouts, throttling, and limits on queued actions as mitigations for unbounded consumption.
Authenticate every endpoint. An unauthenticated model endpoint is an open tab on your account. Require authentication on every inference endpoint, gateway, and MCP server, including internal ones, and rotate the keys your agents use. The exposures Pillar found exploited were unauthenticated Ollama servers, OpenAI-compatible APIs open to the internet, and MCP servers without access controls. Our MCP security guide covers agent authentication in more depth.
Rate-limit by identity, not just by network address. Limit requests and tokens per user, per API key, and per tenant, with tighter limits for anonymous or free-tier traffic. Identity-based limits prevent a single account from consuming a disproportionate share of capacity, which volume abuse and hijacking depend on, whether the source is an outside attacker or an over-eager internal agent.
Constrain inputs and outputs. Set a maximum input length, a maximum output length, and a ceiling on reasoning effort where your provider supports one. Screen retrieved content before it reaches a reasoning model, since OverThink-style attacks arrive through documents and webpages, not the user's prompt. In our experience, sensible limits rarely affect legitimate users and sharply reduce the multiplier an attacker can exploit.
Watch cost per task in real time. Tag every model call with the user, task, and agent that triggered it, and alert on anomalies within minutes, not at month end. Gartner recommends that organizations make AI token costs a cybersecurity indicator. In practice, that means routing cost alerts to the people who respond to incidents, not only to the people who pay the bill.
Who Should Own AI Cost Controls: Finance or Security?
Both, and that is the organizational shift Gartner is pointing to. Gartner, as quoted by Network World, says organizations "will need to treat token consumption and AI usage patterns as both cost management and security concerns." In most companies we work with, finance sees the AI bill monthly, and security rarely sees it at all. That gap is where cost exhaustion attacks live.
A workable split is simple. Engineering owns the limits in code, security owns detection and response, and finance owns the budgets that set the limits. Our earlier guide to why AI bills explode covers the finance side. This post is the security half of the same problem, and both teams should work from one shared view of cost per task.
For multi-agent systems, enforce limits at the orchestration layer instead of trusting each agent. One agent calling another can multiply cost in ways no single agent's budget catches. Our guide to multi-agent AI controls covers that layer, and our AI orchestrator is where we enforce budgets across agents.
Common Questions About Cost Exhaustion Attacks
What is a cost exhaustion attack on AI?
A cost exhaustion attack deliberately drives up the cost of running an AI system. Attackers send requests or plant content that makes a model or agent consume excessive tokens, tool calls, or compute. Gartner predicts that by 2030, 80% of organizations with public-facing AI will have experienced one. OWASP calls the related risk Denial of Wallet.
How is denial of wallet different from denial of service?
Denial of service aims to make a system unavailable. Denial of wallet aims to make it expensive. Cloud AI services usually scale to meet demand, so instead of going down, the system keeps serving the attacker and bills you for it. OWASP lists Denial of Wallet under LLM10:2025, Unbounded Consumption.
Aren't AI costs falling anyway?
The cost to reach a given performance level has fallen roughly 13-fold per year since 2023, according to the State of AI Report 2026, based on Epoch AI estimates. Total bills are different. Agents make many model calls per task, so cheaper calls often lead to more calls, and attackers exploit that multiplier.
What is the first AI cost control to put in place?
Authenticate every AI endpoint and set a tight budget per task. Unauthenticated endpoints are the easiest to hijack, and a per-task budget stops runaway loops and amplification attacks from turning one request into hundreds of billed calls. Then add real-time cost alerts that reach your security team, not only finance.
If you are putting AI in front of customers or letting agents run unattended, talk to the Golabs team. We will review where your spending limits live today and help you move them into the code. Our tailored AI agents include budgets, rate limits, and cost telemetry from day one.