OWASP LLM10: Unbounded Consumption has emerged as a critical threat category in the OWASP Top 10 for LLM Applications. Unlike classic prompt injection or data leakage attacks, this class targets computational resources by forcing models to execute disproportionately expensive tasks.
Large language models now serve as primary interfaces in corporate assistants, RAG applications, AI agents, code generation, and document automation. As adoption grows, attackers increasingly craft single prompts that maximize token usage, context window pressure, and inference cost rather than stealing data or bypassing filters.
The research tested two leading Russian models — YandexGPT Lite 5 and GigaChat Lite — using the AI Red Team platform containing over 200 resource-consumption prompts. Attack classes included Quine-like recursion, fractal nesting, computational explosion, semantic superposition, multi-agent simulation, and glitch-token abuse.
YandexGPT Lite 5 employed multiple strategies: strict 512-token output limits, explicit refusals with scope reduction suggestions, and semantic degradation that preserved usefulness while avoiding full materialization of repetitive or exponential content. In several cases the model recognized excessive scale before expensive generation began.
GigaChat Lite consistently attempted to reduce task scope rather than refuse outright. It answered questions about calculating pi by explaining the method instead of emitting millions of digits and handled large graph problems by describing algorithms rather than enumerating all Hamiltonian cycles.
Both models demonstrated graceful degradation that limits resource expenditure while retaining informative value. The study was conducted with support from the Foundation for Assistance to Innovations and provides concrete prompt examples solely for research and defensive development purposes.
