Attackers use cost harvesting by driving excessive AI usage so the organisation pays for inference, retrieval, storage, or downstream actions. They may automate high-volume requests, induce retries, or trigger expensive tools and workflows. Defenders should set quotas, anomaly detection, per-user limits, and spend monitoring, and review prompts that can cause costly loops.
How cost harvesting works as an abuse pattern
cost harvesting is an abuse of compute, retrieval, or orchestration spend rather than a direct theft of data. The attacker aims to turn your AI stack into a billing engine by creating work that is legitimate enough to execute but expensive enough to matter. That makes the control problem about both abuse detection and cost containment, not just prompt filtering.
The pattern is effective because many AI systems charge by request volume, token usage, retrieval activity, tool invocation, or downstream automation. If a workflow can be driven repeatedly, retried, or chained into other services, the attacker can amplify cost without needing privileged access. That is why spend controls and runtime limits belong alongside traditional security controls.
In practice, cost harvesting often appears as looping prompts, forced retries, unusually long generations, retrieval floods, or requests that trigger expensive tools and secondary workflows. The malicious intent may be obvious only after the fact, especially when the traffic resembles normal user activity at the protocol level.
Where the spend comes from
Attackers usually target whichever part of the AI pipeline turns a request into billable work. That can be inference, vector search, document retrieval, external tool calls, file processing, or background jobs triggered by the model. The cost does not need to be dramatic per request, because scale turns small inefficiencies into a meaningful loss.
A common failure mode is that the system treats every invocation as equally trustworthy. If one request can cascade into multiple model calls, repeated retrievals, and follow-on actions, the attacker can multiply cost through orchestration rather than through raw volume alone. That is why expensive workflows need explicit bounds, not just authentication at the front door.
Harvester activity is also attractive when pricing is opaque to business owners. If teams do not know which prompts, users, or integrations produce the highest spend, they will miss low-and-slow abuse until invoices or quota alerts reveal the pattern.
How defenders stop cost harvesting without breaking legitimate use
The most effective controls are rate and spend controls that match the actual billing model. Set quotas by tenant, user, API key, and workflow, then pair those limits with anomaly detection that looks for retries, bursty usage, repeated tool calls, and abnormal spend per session. Spend monitoring should be operational, not monthly.
Review prompts and workflows that can create expensive loops, especially those that trigger retrieval recursion, tool chaining, or automated retries. If a prompt can repeatedly invoke costly actions without a hard stop, it should be treated as a business-risk control issue. Use NIST AI Risk Management Framework to structure those controls around measurable risk, and align the runtime limits with NIST Cybersecurity Framework 2.0 detection and response practices.
For systems that expose APIs or autonomous tooling, the same abuse can ride through legitimate interfaces. A resource that unexpectedly spikes resource use can be just as harmful as a classic denial-of-wallet attack, so controls should cap consumption at the workflow level, not only the account level. The OWASP API Security Top 10 is useful here because unrestricted consumption and broken authorization often show up as the path to runaway spend.
Risk and Threat Considerations
Cost harvesting creates a direct financial exposure, but it also creates an operational one. If an attacker can force expensive AI behaviour at scale, they can degrade service, exhaust budget, and distract responders while remaining within nominally valid request patterns.
Failure mechanism: The attacker exploits billing-linked actions, such as repeated inference, retrieval, retries, or tool execution, until the cumulative charge becomes material or the budget is exhausted.
Impact: Organisations can face sudden cost spikes, throttling of legitimate users, delayed operations, and reduced confidence in AI services that were assumed to be bounded by normal application controls.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | GOVERN — Govern | Cost harvesting is an AI risk governance problem requiring controls on spend and abuse. |
| Recommendation — Set governance controls that bound AI spend, abuse detection, and escalation thresholds. | ||
| NIST CSF 2.0 | DE.CM-03 — Personnel activity is monitored to detect potential cybersecurity events | Abnormal usage and retry patterns are the detection signal for cost harvesting. |
| Recommendation — Monitor AI usage patterns for bursts, loops, and anomalous spend per actor. | ||
| OWASP API Security Top 10 | API4 — Unrestricted Resource Consumption | Cost harvesting is fundamentally a resource-consumption abuse pattern. |
| API5 — Broken Function Level Authorization | Attackers abuse overbroad function access to trigger expensive workflows. | |
| Recommendation — Cap request rates and consumption to prevent runaway paid operations. Restrict who can invoke costly functions and automation paths. | ||
Practitioner Guidance
What to verify: Check whether your highest-cost workflows have per-request ceilings, per-tenant quotas, and a defined abort condition. If you cannot point to the control that stops an individual conversation or job from cascading into repeated paid actions, the system is too easy to harvest.
Decision rule: If a prompt, agent, or integration can trigger external calls, retrieval recursion, or retries, treat cost control as a production safeguard, not an optimisation task. Use the alerting threshold that reflects abnormal spend per actor or workflow, not a generic infrastructure budget threshold.
Practitioner takeaway: Cost harvesting is best defended by making expensive behaviour observable, bounded, and attributable before attackers turn legitimate AI usage into a billing attack.
Related resources from NHI Mgmt Group
- What happens when attackers use trusted professional personas to deliver a credential-harvesting link?
- Why do passwords remain dangerous when attackers use AI to find vulnerabilities?
- How should security teams reduce fraud when attackers use deepfakes and synthetic identities?
- How should security teams handle exposed cloud keys before attackers use them?