Resource Overload
- Input / Prompt
- Tools & External Data
Attackers deliberately exhaust an agent's computational, memory, or external-service capacity — including self-triggered task spawning and multi-agent coordination — to degrade performance or cause failure.
What it is
Resource overload deliberately exhausts an agent's computational, memory, or external-service capacity — including self-triggered task spawning and multi-agent coordination — to degrade performance or cause outright failure. It differs from a traditional denial-of-service target because an agent's own architecture multiplies the attack surface: resource-intensive inference, chained tool calls, and dependencies on several external services each become their own exhaustion point, and a single triggering event can fan out into many. The threat extends Unbounded Consumption (LLM10) into a specifically agentic failure mode: because agents autonomously schedule, queue, and retry tasks without direct human oversight, and can spawn or delegate to further agents, an attacker who triggers one entry point can drive several agents to consume shared capacity simultaneously, not just their own inference budget.
Attack scenarios
An attacker bombards a multi-agent research system with requests that trigger every specialist agent simultaneously, exhausting the shared API quota and starving legitimate users.
Inference-time exploitation
Specially crafted input forces an agent's most resource-intensive analysis path, overwhelming processing capacity and delaying real-time decisions the system was supposed to make quickly.
API quota depletion
A flood of requests triggers excessive external API calls, rapidly exhausting the system's quota, blocking legitimate use, and running up operational cost before any budget check trips.
Memory cascade failure
Multiple complex tasks that each require extensive memory allocation are initiated in parallel, fragmenting and exhausting memory system-wide and disrupting services well beyond the one directly targeted.
IoT sensor flooding
An attacker exploits an insecure integration to loop fabricated sensor events into a monitoring agent, which prioritizes processing the flood over real alerts and creates a blind spot without ever needing physical access.
Mitigations
- Cap runs with a hard budget kill switch
- Token / Cost Tracking enforces a ceiling on spend and call count per run, independent of whether any single agent tracks its own budget.
- Contain and rate-limit at the execution boundary
- Sandbox Execution bounds CPU, memory, and system-call limits per tool run, and rate-limiting caps request volume and concurrent AI-initiated modifications.
- Track consumption across agents, not just per agent
- Monitor cumulative resource use across every agent in a system, since a coordinated bombardment is invisible to a check that only watches one agent's own quota.
- Auto-suspend on threshold breach
- Enforce automatic suspension of any process that exceeds a predefined resource-consumption threshold, so a runaway loop is contained before it cascades.