Forcepoint: Runaway AI Agents Can Quietly Turn Tool Loops Into Cloud Bills

Enterprise AI agents can create a security problem without leaking data or executing malicious code. If an agent has no enforced stopping point, a single task can branch into hundreds of downstream calls and quietly push cloud spending far beyond its intended budget.

New research from Forcepoint examines this risk through OWASP’s “unbounded consumption” category. The issue covers excessive inference, recursive tool use and other workloads that consume compute or paid API capacity until the service owner faces what researchers call a denial-of-wallet event.

Normal-looking requests can trigger abnormal costs

In a Forcepoint simulation, a vulnerable research agent followed related topics from a poisoned data source until it reached a 500-call demonstration cap, generating a simulated $10 bill. A defended version detected the abnormal fan-out and stopped after one call at a simulated cost of two cents. The test is illustrative, not evidence of a real customer breach.

The problem is distinct from prompt injection. An attacker does not necessarily need to override the model’s instructions. A compromised source can simply return a large list of follow-up items, while an agent obediently expands the task using its approved tools.

Traditional per-request rate limits are a weak defense because each individual call may look legitimate. Security and platform teams need hard spending caps per agent, user and API key, along with circuit breakers, recursion-depth limits and maximum step counts enforced during every run.

Cost attribution also belongs in security telemetry. Monitoring should show which identity, tool and workflow generated the spend, then flag deviations from normal behavior before the monthly bill arrives. As autonomous systems gain permission to search, transact and modify enterprise data, financial containment becomes part of the agent security boundary.