Denial-of-Wallet: One Bad Tool Can Make Your Agent Bill You 14,293x
Your agent does not need to be hacked to be robbed. It just needs to remember. That is the thesis of Persistent Billable State, a paper by Jinqian Zhang and six co-authors on what they call denial-of-wallet attacks against tool-calling agents.
The mechanism is boring, which is why it works. When a runtime carries a tool's return value into later turns, the provider bills it again, every turn. A malicious or compromised tool, once admitted, can stuff that return with content and turn it into recurring processing on the victim's bill, with no credentials and no local privilege. The authors derive six attack vectors and build DOW-BENCH to test them across six model families. In 243 runs, the worst session's cumulative input reached 14,293 times its first call. Even without an attacker, just keeping raw history raises mean session cost 21.2 to 35.9%.
The defense is not deleting history. Deletion broke most tasks, 2 of 12 history-dependent tasks succeeded. Compression kept 10 or 11 of 12 working. The authors pair deterministic history transforms with four host-side invariants that cap prompt mass, context growth, recursion and cumulative spend before anything is re-ingested. That kernel contained every recurring attack in their replay corpus. A progress-aware budget beat a fixed cap on Mistral Small 4 workflows, 22 of 24 successes versus 13.
The ecosystem number is the one to quote: of 3,830 MCP server and transport repositories scanned, only 71 show any code-visible safeguard, and none cover all four families. Anyone running agents with third-party MCP tools is exposed today. This is the cost side of the same story as Ember-1 and last week's price cuts. Everyone is fighting over the price per token. The attack is on the number of times you pay for it.
Link: arxiv.org/abs/2609.28585
← Back to all articles
The mechanism is boring, which is why it works. When a runtime carries a tool's return value into later turns, the provider bills it again, every turn. A malicious or compromised tool, once admitted, can stuff that return with content and turn it into recurring processing on the victim's bill, with no credentials and no local privilege. The authors derive six attack vectors and build DOW-BENCH to test them across six model families. In 243 runs, the worst session's cumulative input reached 14,293 times its first call. Even without an attacker, just keeping raw history raises mean session cost 21.2 to 35.9%.
The defense is not deleting history. Deletion broke most tasks, 2 of 12 history-dependent tasks succeeded. Compression kept 10 or 11 of 12 working. The authors pair deterministic history transforms with four host-side invariants that cap prompt mass, context growth, recursion and cumulative spend before anything is re-ingested. That kernel contained every recurring attack in their replay corpus. A progress-aware budget beat a fixed cap on Mistral Small 4 workflows, 22 of 24 successes versus 13.
The ecosystem number is the one to quote: of 3,830 MCP server and transport repositories scanned, only 71 show any code-visible safeguard, and none cover all four families. Anyone running agents with third-party MCP tools is exposed today. This is the cost side of the same story as Ember-1 and last week's price cuts. Everyone is fighting over the price per token. The attack is on the number of times you pay for it.
Link: arxiv.org/abs/2609.28585
Comments