# R-06·OWASP LLM06:2026·cases 2·checked Nov. 15, 2026
Unbounded consumption and model theft
Uncontrolled use of an AI service runs up costs, knocks it over, or lets someone copy the model through its outputs.
What it is
Inference costs money per request, and attackers can trigger expensive work cheaply: long inputs, reasoning loops, agents that fan one request out into many tool calls, or simply stolen API keys. OWASP calls this cost asymmetry.
The same entry covers model extraction. Repeated querying can be used to copy a model's behavior into another model, a practice U.S. agencies described at industrial scale in a September 2026 advisory.
Documented cases
Incidents happened in the wild. Research demos were shown by researchers, often disclosed to the vendor first.
Incidentdisclosed Sept. 8, 2026·AML.CS0076 Industrial-scale distillation of U.S. models
NSA, CISA and the FBI say six named China-based AI companies collected outputs from U.S. models over millions of exchanges, from at least late 2024, and used them to train their own models.
The advisory asks model providers to watch for anomalous accounts and usage, rate-limit, verify identities, log telemetry and share intelligence across providers.
Sources: NSA, CISA and FBI; MITRE ATLAS AML.CS0076
Incidentdisclosed May 6, 2024·AML.CS0030 LLMjacking: stolen cloud keys used to run up AI bills
Attackers took cloud credentials from a server running a vulnerable version of Laravel (CVE-2021-3129) and used them to reach cloud-hosted language models. Their script checked stolen keys against ten AI services, including AWS Bedrock, Azure, OpenAI and Google Vertex AI.
Sysdig estimated a worst case of more than $46,000 a day in model costs for the victim. That figure assumes maximum quota use in several regions. Its advice: patch, keep secrets out of plain text, scope credentials tightly and log model invocations.
Sources: Sysdig Threat Research Team; MITRE ATLAS AML.CS0030
Controls to start with
- Rate-limit requests and cap input size.LLM06:2026, mitigation 1
- Set hard spending caps on every AI account and API key.LLM06:2026, mitigation 2
- Limit how many actions an agent can queue, and watch for tool interactions that consume heavy resources.LLM06:2026, mitigations 6 and 8
- If you offer a model to others, watch for anomalous accounts and usage patterns that suggest distillation, and share what you find with other providers.Mitigations
Questions to ask vendors
Our suggestions, not taken from a framework.
- What spending and rate limits can we set, and what happens when they are hit?
- How would we know if one of our keys was being used by someone else?
Sources
- OWASP Top 10 for LLM Applications 2026. OWASP GenAI Security Project, Aug. 3, 2026.
- China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies (AA26-251A). NSA, CISA and FBI, Sept. 8, 2026.
- OWASP Top 10 for Agentic Applications 2026. OWASP GenAI Security Project, Dec. 9, 2025.
- MITRE ATLAS data, release 2026.10. MITRE, Oct. 28, 2026.
- NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. National Institute of Standards and Technology, July 2024.
- LLMjacking: Stolen Cloud Credentials Used in New AI Attack. Sysdig Threat Research Team, May 6, 2024.