Isolated Laboratory Verification of Token Amplification, Fan-Out Storms, and Compute Quotas
A single crafted prompt forces an assistant to spawn hundreds of parallel tool calls, expand sponge context inputs, or run unbounded reasoning loops that exhaust GPU capacity and inference budgets. To protect live services, this check runs strictly in isolated lab mode, where the wire filter proves missing quota bounds without generating real load and compiles a deterministic budget contract.
Unbounded consumption in language model and agent deployments—often termed Denial-of-Wallet—occurs when an endpoint permits unrestricted output token ceilings, unthrottled parallel tool fan-out, or recursive sub-agent spawning from a single user request. Unlike classic network floods, a single small request can multiply into thousands of expensive inference and tool invocations.
Security Officer (Plain Meaning): Halts "Unbounded token generation (> 4096 tokens/turn) or 256x parallel subagent fan-out amplification" before socket (0 live DB damage, signed GOST receipt)
IT Auditor & SecOps (Evidence): Scope OWASP LLM10:2025 / ASI08 | Wire Rule SEC-ZD-AI-10 | Formal Witness 5e92a10b84c31f72
Technocrat, CTO & VC (Moat): Z3 Invariant (assert (and (<= max_output_tokens 4096) (<= tool_fanout_p... | FP = 0.0% | Contract IMMUNE-AI-5E92A10B (mcp-sentinel 1.1.2)1. Thought-to-Action Interception and Contract Schematic for AI-DOW-10
Deterministic verification flow for AI-DOW-10 (OWASP LLM10:2025 / ASI08, MITRE ATLAS AML.T0034): candidate probe interception by wire filter SEC-ZD-AI-10, differential proof via witness 5e92a10b84c31f72, and synthesis of gateway contract IMMUNE-AI-5E92A10B for mcp-sentinel.
2. In-Path Mutation Blocking and Formal Solver Invariant for AI-DOW-10
Because active load generation can degrade live GPU queues or incur billing spikes, class AI-DOW-10 is isolated into explicit laboratory mode (LAB_ONLY). Under rule SEC-ZD-AI-10, the software wire filter inspects requested token ceilings, tool fan-out cardinality, and recursion depth parameters before any request reaches the inference engine.
In laboratory verification, the sandbox proves the missing budget bound deterministically by evaluating the request AST and parameter thresholds against hardened quota decoys, recording formal witness 5e92a10b84c31f72 in the Streebog-256 ledger without starving worker processes.
Class Identifier: AI-DOW-10 (denial_of_wallet_token_exhaustion)
Taxonomy Concordance: OWASP LLM10:2025 / ASI08 | MITRE ATLAS AML.T0034
Execution Mode: Isolated Laboratory Mode (LAB_ONLY)
Candidate Probe: POST /api/v1/lab/ai-dow/run {"max_tokens":1000000,"parallel_tool_calls":256,"recursive_subagents":64}
Blocked Mutation: Unbounded token generation (> 4096 tokens/turn) or 256x parallel subagent fan-out amplification
Z3 Solver Invariant: (assert (and (<= max_output_tokens 4096) (<= tool_fanout_per_turn 5) (<= reasoning_recursion_depth 4)))
Wire Sandbox Rule: SEC-ZD-AI-10
Formal Witness Hash: 5e92a10b84c31f72
Compiled Sentinel Rule: IMMUNE-AI-5E92A10B (mcp-sentinel 1.1.2)3. Autonomous Synthesis of Gateway Contract IMMUNE-AI-5E92A10B and Streebog-256 Receipt
From witness 5e92a10b84c31f72, the compiler synthesizes contract IMMUNE-AI-5E92A10B for border enforcement. The rule enforces hard upper bounds on per-turn token generation, maximum parallel tool invocations, and sub-agent recursion depth inside mcp-sentinel.
4. Engineering Reference Notes for AI-DOW-10
Why Denial-of-Wallet checks are separated into isolated laboratory mode
Keeping resource-amplification checks in explicit laboratory mode prevents routine automated security scans from consuming production GPU memory or external inference quotas.
Prevention of recursive tool-call storms in autonomous workflows
The gateway tracks a per-request token and tool-call budget counter in memory, terminating any session that exceeds the configured fan-out or iteration ceiling at the gateway boundary.