Agentic systems can fan one prompt into many background tasks, so abuse scales much faster than in traditional applications. That creates a financial attack path where an attacker or spoofed agent can burn token and GPU capacity at machine speed, turning identity abuse into direct cost leakage.
Why agentic systems turn abuse into spend much faster
Agentic systems do not just answer once, they can turn one instruction into a chain of background actions. That means a hostile prompt, a spoofed agent, or a compromised integration can trigger repeated model calls, tool invocations, retrievals, and retries before anyone notices. The core issue is not only abuse of logic, but abuse of metered compute at machine speed.
When the system is designed to be proactive, the attacker can push cost into the same execution path that produces value. A single request may fan out across planners, subtasks, memory lookups, code execution, and external APIs, so each unwanted action can create a fresh billable event. That makes Denial of Wallet a natural abuse pattern for agentic architectures rather than a side effect.
Why identity abuse becomes a financial attack path
Agentic systems often operate with delegated authority, which widens the blast radius of a bad actor who can impersonate a user, reuse a session, or hijack an agent relationship. If the platform cannot tell which actions are genuinely authorised, the system may keep spending tokens, GPU time, and third-party tool quota on behalf of the attacker while appearing to behave normally.
That is why identity and authorisation boundaries matter even when the immediate harm is financial. The attack does not need to steal data to be effective, it only needs to persuade the system to keep acting. Resources such as the AI Agents vs Agentic AI guide and the AI Agent Authorisation Guide are useful references for understanding how autonomy level and per-action policy decisions change the abuse surface.
Agentic systems also create more opportunities for compounding abuse because one compromised identity can spawn many costly actions downstream. The Agentic AI Identity Guide is a practical reference for the delegation and registration patterns that determine whether an agent can be trusted to spend resources safely.
What to control when metering, delegation, and scale all interact
The most important design choice is whether the system can spend money independently of a fresh, checkable decision. If task fan-out, retries, or tool chaining are allowed without meaningful limits, then cost becomes part of the exploit path. In practice, the attack surface grows with every place the agent can loop, replan, or call out to another service.
That is why visibility and containment are as important as model quality. Logging should make it possible to tie spend back to a request, principal, and purpose, while policy should limit how much work any single identity can cause in one session. The AI Agent Observability, Audit and Incident Response Guide helps connect those signals to investigation and kill-switch decisions, and the Zero Trust for AI Agents guide shows why standing privilege and blind trust are especially dangerous in this model.
For practitioners, the lesson is that the cheapest attack is often the one that never needs persistence. A one-time spoofed request that triggers high-volume inference, repeated retrieval, or expensive tool use can produce material loss before traditional incident controls register a problem.
Risk and Threat Considerations
Denial of Wallet is attractive because it converts access into immediate consumption. In agentic systems, the attacker does not need to break the model to create loss, they only need to steer the orchestration layer into repeated work, oversized context use, or expensive external calls.
Failure mechanism: A spoofed principal, abused session, or overtrusted agent relationship triggers uncontrolled fan-out, retries, or recursive tool use, which multiplies billable inference and infrastructure spend faster than manual review can stop it.
Impact: The organisation can see sudden cost spikes, quota exhaustion, service degradation, and secondary outages if shared capacity is saturated or throttled. In multi-tenant or budget-capped environments, the financial loss can arrive before there is clear evidence of data theft or destructive activity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST AI RMF, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agentic cost abuse often depends on hijacked or overtrusted identity and delegated privilege. |
| ASI02 — Tool Misuse | Denial of Wallet can be driven by abusive tool calls, retries, and fan-out that inflate spend. | |
| Recommendation — Limit agent authority per action and require fresh policy checks for costly operations. Constrain tool access and block uncontrolled loops that can multiply billable usage. | ||
| NIST AI RMF | GOVERN — Govern | Agentic systems need governance for accountability, cost oversight, and risk ownership. |
| Recommendation — Define ownership and escalation for model spend, abuse thresholds, and shutdown authority. | ||
| CIS Controls v8 | CIS-5 — Account Management | Abuse of accounts and sessions is a common path to unwanted resource consumption. |
| Recommendation — Review and disable unnecessary accounts, sessions, and access paths that can drive cost. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Excess privilege lets an abused agent invoke expensive actions beyond its intended scope. |
| Recommendation — Apply least privilege so compromised agents cannot trigger high-cost actions without restriction. | ||
Practitioner Guidance
What to prioritise: Treat spend controls as a security control, not just a FinOps concern. The first control objective is to make every expensive action attributable to a request, identity, and policy decision, because attribution is what lets you stop abuse quickly.
What to verify: Check whether the system enforces per-action limits, session caps, tool-use ceilings, and approval gates for unusually costly operations. Also verify that retries, planner loops, and background jobs cannot bypass the same control path.
Common mistake: Teams often secure the prompt surface but leave the budget surface open. If an attacker can still cause repeated inference, repeated retrieval, or repeated tool execution under a valid-looking session, the system remains exposed to cost abuse even when content filters are strong.
Practitioner takeaway: The deciding factor is not whether the agent is intelligent, it is whether the system can keep it economically bounded when identity is abused.
Related resources from NHI Mgmt Group
- Why do AI agents increase non-human identity risk in existing IAM programmes?
- When does just-in-time access reduce risk for agentic AI, and when does it fall short?
- How should security teams limit the risk from AI agents that have access to production systems?
- Why do AI agents increase non-human identity risk?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org