OWASP Top 10 for LLM Applications, 2025
LLM10: Unbounded Consumption
Unbounded consumption happens when an LLM application lets users run excessive, uncontrolled inference. OWASP says this can cause denial of service, economic loss, model theft and degraded service, and that the high compute cost of running models, especially in the cloud, makes them easy to exploit.
Unbounded Consumption in more detail
A common form is denial of wallet, where an attacker drives up the bill by abusing pay-per-use pricing. Others include flooding the model with oversized or endless inputs, sending resource-heavy queries, and using the API to collect outputs that can train a copy of the model. The standard controls are input size limits, rate limiting and quotas, timeouts, monitoring for unusual usage, and limiting how much detail the API returns about probabilities. In our directory, guardrail and AI gateway tools are the category scored on this risk.
The risk and its name come from OWASP; the summary, examples and controls on this page are our plain-English reading of OWASP's page. Source: Source, checked October 21, 2026: genai.owasp.org (opens in a new tab)
How it shows up
- Inputs of varying length overload the model and exploit processing inefficiencies.
- An attacker exploits pay-per-use pricing to drive up cloud costs (denial of wallet).
- Inputs that repeatedly exceed the context window degrade the service.
- Complex, resource-intensive queries drain capacity.
- Crafted queries collect enough output to build a partial copy of the model.
Controls that reduce it
- Enforce reasonable limits on input size.
- Apply rate limits and per-user quotas.
- Use timeouts and throttling for expensive operations.
- Monitor resource use and flag unusual patterns.
- Restrict how much probability detail the API exposes in responses.
- Keep a central model inventory and use access controls on model repositories.
Controls reduce risk, they do not remove it
No single control covers unbounded consumption on its own. Combine controls, and treat any tool as one layer.
Categories that address it
Our analysisThese are the directory categories whose tools we score on this risk. The mapping is our analysis.
Layers that address this risk
Our AI security layers are an editorial model, not a standard. Source states means OWASP's own text for LLM10 names the control the layer delivers. Our analysis means we drew the link.
- L2 Discovery and posture Source states
- L6 Runtime guardrails Source states
- L8 Monitoring and response Source states
Tools mapped to LLM10
Our analysis6 tools are mapped. Each tool is mapped only where a documented capability supports it. Open a tool page to see the capability and its source. Coverage Score compares tools within one category.
| Tool | Type | Deployment | Pricing model | OWASP risks | Coverage Score | Last reviewed |
|---|---|---|---|---|---|---|
| Kong AI GatewayKong · Guardrails | Open sourceApache-2.0 |
| Usage-based |
| 65 out of 100 | |
| ARTLF AI & Data Foundation · Red teaming | Open sourceMIT |
| Free |
| 55 out of 100 | |
| Cloudflare AI GatewayCloudflare · Guardrails | Commercial |
| Freemium |
| 48 out of 100 | |
| Radware LLM FirewallRadware · Guardrails | Commercial |
| Not published |
| 41 out of 100 | |
| ModelOp CenterModelOp · Governance | Commercial |
| Not published |
| 33 out of 100 | |
| LLM GuardPalo Alto Networks (Protect AI) · Guardrails Archived | Open sourceMIT |
| Free |
| 66 out of 100 |
No tools match these filters. Clear a filter to see more.
Why each tool is mapped
- Kong AI Gateway: AI Rate Limiting Advanced enforces spend limits per request cost.
- ART: Extraction attacks copy a model through its predictions, the model theft path in LLM10; ART runs them against classic ML models.
- Cloudflare AI Gateway: Rate limits and spend limits cap request volume and cost.
- Radware LLM Firewall: A token watchdog limits input and output tokens.
- ModelOp Center: Monitoring includes token usage and cost tracking.
- LLM Guard: A Token Limit scanner caps how long a prompt can be.