Every category so far in this series has been about content or trust going somewhere it shouldn’t — into a model’s context, out of a vector store, across a permission boundary. This one is different: it’s not about what the model says or does. It’s about what happens when nobody puts a limit on how much of the model an attacker is allowed to use.
Per the official OWASP entry, unbounded consumption occurs when an LLM application allows excessive and uncontrolled inference — leading to denial of service, runaway financial cost, model theft, or general service degradation. The category exists because LLM inference is expensive by nature, especially in cloud environments billed per token or per request. A system with no limit on how much of that expensive resource any single user can consume isn’t just a performance risk. It’s a direct line to your budget.
The Case: Sourcegraph’s Leaked Token
On August 30, 2023, Sourcegraph disclosed a security incident that started with an ordinary mistake: an admin access token, accidentally committed on July 14, sat exposed for six weeks before anyone used it.
When someone finally did, they didn’t go looking for source code or customer data. They used the token’s admin privileges to do something narrower and, in a way, more interesting: they elevated a newly created account to site-admin, and used that access to increase the API rate limits for a small number of accounts — including their own.
Then they built a proxy app. Anyone could create a free Sourcegraph.com account, generate an access token, hand it to the attacker to have its rate limit inflated, and get unrestricted access to Sourcegraph’s paid Cody LLM API — for free. Instructions on how to use the proxy circulated widely. According to reporting at the time, they racked up close to two million views.
The Attack Revealed Itself
Here’s the detail that makes this a genuinely useful LLM10 case study: Sourcegraph’s security team didn’t find this through a code audit or a tip. They found it because of the attack’s own footprint. The sudden, massive spike in API usage — hundreds or thousands of free users suddenly hammering a paid inference endpoint — was the signal that something was wrong. The same-day detection happened because unbounded consumption is, almost definitionally, loud. It shows up in your bill and your traffic graphs before it shows up anywhere else.
Sourcegraph’s response was fast and specific to the resource-abuse nature of the incident: they revoked the malicious account, rotated potentially exposed license keys, and — notably — temporarily reduced API rate limits for all free community users, a direct acknowledgment that the fix for unbounded consumption is bounding it.
A Second Pattern: Denial of Service Through the Upload Path
Not every unbounded consumption vulnerability is about inference cost. CVE-2026-55446, in Langflow, shows the same category of risk from a different angle: an attacker sends a request to the file upload endpoint with no authentication at all, using an abnormally long multipart form boundary. The malformed request is enough to make the entire application “unusable for all users for an indefinite amount of time.” No inference happens. No tokens are consumed. The resource being exhausted is the application itself, not the model — but the underlying failure is the same one OWASP groups under this category: no limit was placed on what a single, unauthenticated request was allowed to cost the system.
Why This Category Is Different From the Rest of the List
Most of the categories in this series describe an attacker manipulating the model into doing something it shouldn’t. Unbounded consumption doesn’t require manipulating anything. The Sourcegraph attacker didn’t jailbreak Cody or craft an adversarial prompt — they used a completely legitimate feature (rate limit configuration) exactly as designed, just with privileges they weren’t supposed to have. The Langflow flaw doesn’t involve the model at all. In both cases, the vulnerability isn’t in what the AI does. It’s in the absence of a ceiling on how much of it anyone can use.
That distinction matters for how you think about defending against it. You can’t fix unbounded consumption by making your model smarter or your prompt filtering stricter. The fix lives entirely in infrastructure: rate limits enforced per user rather than per admin-configurable setting, resource caps on individual requests, monitoring that treats a sudden usage spike as a signal rather than a success metric.
Mitigations
OWASP’s recommended controls read like standard resource-management discipline, applied specifically to inference cost:
• Enforce strict API rate limits per user or per API key, not just at the account-admin level where a single compromised credential can override them
• Cap resource use per request — limit input length, output length, and the number of reasoning steps or tool calls a single query can trigger
• Set hard limits based on the model’s context window to prevent oversized inputs from forcing expensive processing
• Continuously monitor resource utilization for the kind of abnormal spike that revealed the Sourcegraph incident — treat a usage graph anomaly as a security signal, not just a scaling problem
• Validate and sanitize all inputs before they reach the inference layer, including structural validation (like multipart form boundaries) that has nothing to do with the model itself
What This Means If You’re Building With LLMs
The Sourcegraph incident and the Langflow CVE point at the same underlying gap from two different directions: an inference API is a metered resource, and metered resources need a ceiling that doesn’t depend on any single account, token, or configuration setting staying secure forever. The Sourcegraph team’s own admin token was the failure point — not a prompt, not the model, not a jailbreak. Once that one credential was compromised, the only thing standing between “one leaked token” and “unlimited free access to a paid LLM API for anyone with an internet connection” was a rate limit that the same compromised credential could change. A limit that can be raised by the thing that compromised it isn’t really a limit.