Not long ago, many companies began actively implementing AI agents in a wide variety of workflows. Very quickly, the cost of using them became a pressing issue for companies. Moreover, it\u2019s an issue that concerns more than just finance department \u2014 in addition to budgetary concerns, issues of reliability, operational stability, and even information security have emerged. This is because the cost of automating one and the same process varies significantly from one deployment to the next, is unpredictable, and could be subject to external influences.<\/p>\n
Furthermore, for a malicious actor attacking an organization, any process automated using AI and vulnerable to external influence is, in essence, a convenient target for a \u201cnew type of DDoS attack\u201d. Application-error reports, product reviews, or technical support requests can (just like any other external data that a company processes via AI) serve as a tool in an attack aimed at increasing consumption of tokens (word fragments that serve as the basic unit of input and output of an LLM).<\/p>\n
In 2026, large companies significantly overspent on their AI system budgets for the first time. Uber had spent its entire annual budget by April<\/a>, while an unnamed company failed to set spending limits for Claude and spent $500 million in a single month<\/a>. Although AI providers regularly announce lower prices and more efficient models, the shift from chatbots to agentic systems that operate continuously and autonomously increases token consumption by hundreds or thousands of times<\/a>.\u00a0 At the same time, the \u201cfixed subscription for $20 or $100\u201d model for companies is becoming a thing of the past; all major providers are transitioning business clients to pay-as-you-go billing.<\/p>\n As a result, companies are facing a problem all too familiar to cloud hosting and cellular communications industries. In the absence of specialized cost accounting and management systems, an organization only learns how much a particular process or project will cost after it\u2019s completed. In the telecom and cloud sectors, this problem was eventually solved through the development of sophisticated billing systems, and their clients have even adopted the specialized term FinOps<\/a>. For AI, this process is still in its infancy. Moreover, solving the problem will be complicated by the probabilistic nature of generative AI.<\/p>\n To understand why costs rise so quickly and are so difficult to predict and control, we need to recall how a language model works and what turns it into an AI agent. The model is stateless; in other words, it does not retain any information between interactions. Every time the agent takes the next step, the entire history of work on a specific task (the context) must be resent to the model: the initial prompt, previous reasoning, the contents of the files it has read, and the responses from all tools. With each step, this \u201crecap\u201d grows longer \u2014 especially if the task involves iterative loops. If a step fails, or the response is unclear, or a tool returns an error, the agent simply tries again \u2014 further inflating the size of the context. And if the task is performed not by a single but by several agents, which divide the work among themselves and exchange results, this volume is multiplied by their number. As a result, token consumption does not increase gradually but in spurts, and it\u2019s nearly impossible to predict it at the start of the task.<\/p>\n When running two different sessions of an AI agent interaction to solve exactly the same task (two tech-support tickets, two analytics tasks, and so on), the number of tokens spent on them can vary \u2014 the difference can be as much as 30 (!) times<\/a>. This depends on how many steps, errors, and retries are required to solve the task. Increased resource consumption doesn\u2019t necessarily depend on the complexity of the task. There are well-known cases where AI got stuck in a \u201cthought loop\u201d and wasted an absurd amount of resources on trivial tasks.<\/a><\/p>\n Three generations of AI in enterprise systems consume resources in completely different ways:<\/p>\n Since LLM calls are significantly more expensive than typical standard software calls, automating routine corporate tasks comes at an unusually high cost. For example, Gartner estimates<\/a> that resolving a single customer support request using an LLM costs approximately $3<\/a>. It\u2019s easy to imagine how attackers could bombard a company with thousands of long, sophisticated requests generated by an inexpensive LLM, causing significant financial damage. Since the process is automated, anomalies may not be detected right away.<\/p>\n If an attacker knows which agent system and which LLM are used in a business process, they can carry out a more precise attack and cause significantly greater damage. The authors of the GitInject<\/a> study estimated that an attacker capable of creating GitHub issues within an organization that uses AI agents for error analysis with single attack (before GitHub\u2019s defense mechanisms kick in) can cause up to $111 in damage and burn through 400 minutes of GitHub Actions<\/a> from the victim\u2019s account. Naturally, such an attack can be repeated multiple times \u2014 at no cost to the attacker.<\/p>\n The most dangerous risk \u2014 though difficult to quantify in monetary terms \u2014 comes from attacks that provoke LLMs into excessive reasoning. In the paper OverThink<\/a>, the authors demonstrated how a harmlessly worded task, when fed into a language model, ultimately yields a correct result but, in the process , consumes 46 (!) times more tokens than it should. Moreover, all tasks tested by the researchers successfully passed existing security filters.<\/p>\nUnpredictable token consumption<\/h2>\n
\n
Tokenomics in attacks: denial of wallet as the new DDoS<\/h2>\n