Day 68: Abuse and Cost Attacks

Abuse is not only exfiltration — it is token bombs, recursive agent invokes, and cross-tenant cost amplification. Cap per tenant, per PR, and per run before someone pastes a 2MB log into chat.

⚡ TL;DR: Enforce input size limits, recursion depth, fan-out caps, and per-tenant token budgets with hard stops. Emit cost metrics.

Hard limits

MAX_INPUT_CHARS = 100_000
MAX_DEPTH = 3
MAX_FANOUT = 5

def accept_user_input(text: str):
    if len(text) > MAX_INPUT_CHARS:
        raise ValueError("input_too_large")

def spawn_child(parent_depth: int):
    if parent_depth >= MAX_DEPTH:
        raise RuntimeError("recursion_cap")

Per-tenant caps

export async function charge(tenant: string, tokens: number, redis: Redis) {
  const key = `budget:${tenant}:${new Date().toISOString().slice(0, 10)}`;
  const used = await redis.incrby(key, tokens);
  await redis.expire(key, 86400 * 2);
  if (used > TENANT_DAILY_CAP) throw new Error("tenant_budget");
}

❌ Unlimited recursive “supervisor calls specialist calls supervisor” — that is a cost attack with extra steps.

Closing checklist

• [ ] Input size + depth + fan-out caps
• [ ] Per-tenant daily token budgets
• [ ] Metrics and alarms on cap hits
• [ ] Quotas separate from authz
• [ ] Rate-limit tool invokes

Series navigation

Day 67: Supply Chain: Model and Image Provenance · Day 69: Policy as Code for Shell and Apply

Last updated September 11, 2026