OWASP LLM Unbounded Consumption: How AI Agents Trigger Runaway Cloud Costs — Detection and Guardrail Guide

---
title: High-Volume Outbound Connections to LLM API Endpoints
id: 3f9a1c74-8b2e-4d91-a6f3-5c7e2b8d9012
status: experimental
description: Detects processes establishing repeated network connections to public LLM API endpoints. Baseline your legitimate agent workloads first; alert on hosts that have no business calling LLM APIs or on abnormal frequency from known agents.
references:
  - https://genai.owasp.org/llmrisk/llm10-unbounded-consumption/
  - https://attack.mitre.org/techniques/T1102/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.command_and_control
  - attack.t1102
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'api.openai.com'
      - 'api.anthropic.com'
      - 'generativelanguage.googleapis.com'
      - 'api.mistral.ai'
      - 'api.cohere.com'
      - 'openai.azure.com'
      - 'bedrock-runtime'
      - 'api.x.ai'
  filter_known_agents:
    Image|endswith:
      - '\node.exe'
      - '\python.exe'
      - '\python3.exe'
  condition: selection and not filter_known_agents
falsepositives:
  - Developer workstations testing LLM integrations
  - Legitimate SaaS AI features embedded in business applications
level: medium
---
title: Suspicious Scripting Process Spawning Rapid Sequential Network Activity
id: 8c4e2b16-7a3d-4f52-b9e1-2d6a5c0f8347
status: experimental
description: Detects scripting interpreters and automation runtimes commonly used to host AI agents spawning child processes in rapid succession — a pattern consistent with agentic tool-call loops and recursive task execution.
references:
  - https://genai.owasp.org/llmrisk/llm10-unbounded-consumption/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
      - '\deno.exe'
    Image|endswith:
      - '\curl.exe'
      - '\wget.exe'
      - '\powershell.exe'
      - '\cmd.exe'
      - '\certutil.exe'
  condition: selection
falsepositives:
  - CI/CD pipeline agents
  - Legitimate automation frameworks (Ansible, orchestration workers)
level: medium
---
title: LLM API Key or Agent Configuration Access From Unexpected Process
id: b1d7e493-2c8f-4a65-9d3b-7e4f1a2c6598
status: experimental
description: Detects processes reading files or environment blocks that commonly contain LLM API keys or agent framework configuration — a precursor to key theft enabling attacker-driven consumption abuse.
references:
  - https://genai.owasp.org/llmrisk/llm10-unbounded-consumption/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.credential_access
  - attack.t1552
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\.env'
      - 'openai_api_key'
      - 'anthropic'
      - '\.config\openai'
      - 'agent_config'
      - 'langchain'
      - 'credentials.json'
  filter_legit:
    Image|endswith:
      - '\code.exe'
      - '\python.exe'
      - '\node.exe'
      - '\msbuild.exe'
      - '\devenv.exe'
  condition: selection and not filter_legit
falsepositives:
  - Developers editing environment files
  - Backup and indexing software
level: low

let llm_domains = dynamic(["api.openai.com", "api.anthropic.com", "generativelanguage.googleapis.com", "api.mistral.ai", "api.cohere.com", "api.x.ai", "bedrock-runtime"]);
let lookback = 24h;
let baseline_days = 7d;
// Establish 7-day hourly baseline per device
let baseline = DeviceNetworkEvents
| where TimeGenerated between (ago(baseline_days) .. ago(lookback))
| where RemoteUrl has_any (llm_domains)
| summarize BaselineAvg = avg(todouble(count_)) by DeviceName, bin(TimeGenerated, 1h)
| summarize AvgHourlyCalls = avg(BaselineAvg) by DeviceName;
// Current 24h volume per device
DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where RemoteUrl has_any (llm_domains)
| summarize CurrentCalls = count(), DistinctEndpoints = dcount(RemoteUrl), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName
| join kind=leftouter baseline on DeviceName
| extend DeviationRatio = round(todouble(CurrentCalls) / todouble(coalesce(AvgHourlyCalls, 1.0) * 24.0), 2)
| where CurrentCalls > 500 or DeviationRatio > 5
| project DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, CurrentCalls, AvgHourlyCalls, DeviationRatio, DistinctEndpoints, FirstSeen, LastSeen
| sort by DeviationRatio desc;

let llm_domains = dynamic(["api.openai.com", "api.anthropic.com", "generativelanguage.googleapis.com", "api.mistral.ai", "api.cohere.com", "openai.azure.com"]);
CommonSecurityLog
| where TimeGenerated > ago(6h)
| where DestinationHostName has_any (llm_domains)
| summarize Requests = count(), UniqueSources = dcount(SourceIP), BytesOut = sum(tolong(SentBytes)) by SourceIP, DestinationHostName, bin(TimeGenerated, 15m)
| where Requests > 100
| sort by Requests desc;

-- Identify processes with active connections to LLM API endpoints
-- Scope runaway agent consumption events for containment
LET llm_ips <= SELECT * FROM netstat()
WHERE RemoteIP =~ '^(104\.18|3\.163|34\.|35\.|52\.)'
  AND Status =~ 'ESTABLISHED'

SELECT Pid,
       Name,
       LocalIP,
       LocalPort,
       RemoteIP,
       RemotePort,
       Status
FROM netstat()
WHERE RemotePort = 443
  AND Status =~ 'ESTABLISHED'
  AND Name =~ '(?i)(python|node|deno|langchain|agent)'

-- Enumerate candidate AI agent processes with full command lines
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(openai|anthropic|langchain|llamaindex|autogen|crewai|agent)'
   OR Name =~ '(?i)(python|node|deno)'
ORDER BY CreateTime DESC

# AI Consumption Guardrail Audit — Azure
# Verifies budget alerts, action groups, and inventories AI resource deployments

$ErrorActionPreference = 'Stop'
$context = Get-AzContext
if (-not $context) { Connect-AzAccount }
$subId = $context.Subscription.Id
Write-Output "[*] Auditing subscription: $($context.Subscription.Name) ($subId)"

# 1. Verify budgets exist and have notification thresholds configured
Write-Output "`n[1] Checking configured budgets..."
$budgets = Get-AzConsumptionBudget -Scope "/subscriptions/$subId" -ErrorAction SilentlyContinue
if (-not $budgets) {
    Write-Output "[!] WARNING: No consumption budgets configured at subscription scope."
    Write-Output "    Create one: New-AzConsumptionBudget -Name 'AI-Workload-Budget' -Amount 5000 -Category Cost -TimeGrain Monthly"
} else {
    foreach ($b in $budgets) {
        $notifyCount = if ($b.Notification) { $b.Notification.Count } else { 0 }
        Write-Output "    Budget: $($b.Name) | Amount: $($b.Amount) | Notifications: $notifyCount"
        if ($notifyCount -eq 0) {
            Write-Output "    [!] Budget '$($b.Name)' has NO alert notifications — it will not warn anyone."
        }
    }
}

# 2. Verify action groups exist for alerting
Write-Output "`n[2] Checking action groups (alert delivery paths)..."
$actionGroups = Get-AzActionGroup -ErrorAction SilentlyContinue
if (-not $actionGroups) {
    Write-Output "[!] WARNING: No action groups configured. Budget alerts have nowhere to go."
} else {
    $actionGroups | ForEach-Object { Write-Output "    Action Group: $($_.Name) in $($_.ResourceGroupName)" }
}

# 3. Inventory Azure OpenAI / Cognitive Services deployments
Write-Output "`n[3] Inventorying AI service deployments..."
$aiResources = Get-AzResource | Where-Object { $_.ResourceType -match 'CognitiveServices|OpenAI|MachineLearning' }
if ($aiResources) {
    $aiResources | ForEach-Object {
        Write-Output "    $($_.ResourceType) | $($_.Name) | RG: $($_.ResourceGroupName) | $($_.Location)"
    }
    Write-Output "    Total AI resources: $($aiResources.Count)"
    Write-Output "    ACTION: Verify each has per-deployment token rate limits (TPM/RPM) configured."
} else {
    Write-Output "    No Azure AI resources found in this subscription."
}

Write-Output "`n[*] Audit complete. Remediate any [!] findings before the next billing cycle."

#!/bin/bash
# AI Consumption Guardrail Audit — AWS
# Verifies budgets, anomaly detection, and Bedrock invocation logging

set -euo pipefail
echo "[*] Auditing AWS account: $(aws sts get-caller-identity --query Account --output text)"

# 1. Verify budgets exist with notification thresholds
echo "[1] Checking AWS Budgets..."
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
BUDGETS=$(aws budgets describe-budgets --account-id "$ACCOUNT_ID" --query 'Budgets[].BudgetName' --output text 2>/dev/null || echo "")
if [ -z "$BUDGETS" ]; then
  echo "[!] WARNING: No AWS Budgets configured. Create one with notifications at 50/80/100/120% thresholds."
else
  echo "    Budgets found: $BUDGETS"
fi

# 2. Check Cost Anomaly Detection monitors
echo "[2] Checking Cost Anomaly Detection..."
MONITORS=$(aws ce get-anomaly-monitors --query 'AnomalyMonitors[].MonitorName' --output text 2>/dev/null || echo "")
if [ -z "$MONITORS" ]; then
  echo "[!] WARNING: No cost anomaly monitors. Runaway agent spend won't be flagged until the invoice."
else
  echo "    Anomaly monitors: $MONITORS"
fi

# 3. Verify Bedrock invocation logging is enabled (needed for per-model consumption forensics)
echo "[3] Checking Bedrock model invocation logging..."
for REGION in us-east-1 us-west-2; do
  LOGGING=$(aws bedrock get-model-invocation-logging-configuration --region "$REGION" --query 'loggingConfig.s3Config.bucketName' --output text 2>/dev/null || echo "")
  if [ -z "$LOGGING" ] || [ "$LOGGING" = "None" ]; then
    echo "    [!] $REGION: Invocation logging NOT enabled — you cannot forensically reconstruct consumption events."
  else
    echo "    $REGION: Logging to s3://$LOGGING"
  fi
done

echo "[*] Audit complete."