What is a denial of wallet attack?

Denial of wallet (DoW) is an attack whose goal, or whose effect, is to make the victim pay by inflating the consumption of metered cloud services. The name echoes denial of service, the attack that knocks a system offline by flooding it with requests, but here the service stays up and the damage shows up on the invoice. It works because many resources are billed per use: serverless functions, meaning code the provider runs and bills on every single call, and AI model APIs, which charge for every token, the fragment of text a model reads or writes. More requests mean more spending, and the infrastructure scales automatically. OWASP names it explicitly under LLM10:2025 Unbounded Consumption in its Top 10 for applications built on language models. A variant built on stolen credentials has a name of its own: LLMjacking.

See also: AI gateway · The single control point between applications and models: multi-provider routing, keys, quotas, costs and security filters.

From serverless to AI

The term was already in circulation when Kelly, Glavin and Barrett, of the University of Galway, gave it one of its first academic definitions in 2021: the intentional, mass and continual invocation of serverless functions, draining the victim's finances through inflated usage bills. The catch is elasticity: a traditional server under attack collapses and the failure is visible at once, while a service that scales on its own absorbs the load and bills for it. With language models every request costs more, and OWASP describes an attacker firing a high volume of operations at an AI application to shift the cost onto whoever runs it. The countermeasures it lists include rate limiting (caps on how often a single source can send requests), per-user quotas, timeouts and monitoring for unusual consumption.

LLMjacking: the victim pays for the theft

In May 2024 the Sysdig Threat Research Team described and named a variant that bypasses the application: attackers use cloud credentials stolen from a vulnerable system to target ten cloud-hosted language model services and resell that access to other criminals, while the account owner pays the bill. By the researchers' own calculation, at default quotas and in the worst case the cost to the victim can exceed $46,000 a day, and their follow-up report puts it above $100,000 a day with the frontier models of the time, such as Claude 3 Opus. There is a second harm: by maxing out quotas, the attacker also blocks legitimate use of the models. MITRE has since captured the pattern in the sub-technique ATT&CK T1496.004, Cloud Service Hijacking.

An enterprise example

A manufacturer runs a customer support assistant built on a cloud model API. A developer leaves the key in a public repository; on Friday night someone finds it and wires it into a service that resells that access. On Monday the assistant struggles to answer because the quotas are exhausted, and the budget alert lands after the money is spent: the AWS Budgets documentation warns of a delay between usage and notification. The fix works on three levels: short-lived keys with a named owner, the way non-human identities are governed; per-team quotas on an AI gateway; and budgets that act instead of merely warning, such as AWS Budgets automated actions or the spend caps Google Cloud offers for its AI APIs, which pause the service.

Why it matters for decision makers

With pay-per-use AI, cost becomes an attack surface. Budgets, quotas, rate limits, alerts and credential hygiene are security controls as much as FinOps tools, and they should be designed with whoever answers for incidents, not only whoever reads the invoice. The real decision is how much you are willing to lose before an automatic stop kicks in, knowing that a hard cap can shut down a legitimate service. Anyone who understands their own AI tokenomics also knows what anomalous consumption looks like.