Persistent Billable State: Denial-of-Wallet Attacks and Defenses in Tool-Calling LLM Agents

2026-09-23

AI Summary

This study addresses a critical vulnerability in tool-calling LLM agents, where malicious tools can exploit host state retention mechanisms to launch persistent billing attacks. To the best of our knowledge, this work is the first to systematically investigate post-admission lifecycle security. We introduce the concept of "persistently billable states" and construct DOW-BENCH, a benchmark designed to evaluate six categories of denial-of-wallet attack vectors. Furthermore, we propose a defense kernel that enforces context boundaries through four host-side invariant constraints. Experimental results demonstrate that, without protection, single-session inputs can inflate up to 14,293 times their original size. In contrast, the proposed defense kernel effectively mitigates all evaluated attacks, significantly reducing session costs while improving task success rates.

Abstract

Multi-step tool-calling LLM agents rely on host runtimes to preserve state across turns. When a runtime carries an external tool return into later model inputs, providers meter it again. An admitted malicious or compromised tool can thereby convert untrusted data into recurring victim-billed processing without victim credentials or local runtime privilege. We call retained content persistent billable state and formalize the host's decision over whether and how it enters later billable context as the persistent billable-state boundary. We present the first systematic security study of this post-admission lifecycle. We derive six denial-of-wallet attack vectors and build DOW-BENCH, an end-to-end harness evaluated across six model families. Across 243 executions, usage telemetry shows that the maximum per-session cumulative input reaches 14,293x the session's first-call input. Controlled history-policy reruns isolate raw retention's contribution: retaining raw history increases mean effective session cost by 21.2-35.9%. Compression succeeds on 10/12 and 11/12 history-dependent tasks, versus 2/12 under deletion for each provider. To govern this boundary, we combine deterministic history transformation with four host-side invariants that bound prompt mass, context growth, recursive opportunity, and cumulative spend before reingestion. The kernel contains every recurring attack in the 123-evaluation replay corpus. Across 24 Mistral Small 4 workflows, a progress-authorized policy achieves 22/24 oracle-verified task successes with no pre-completion interruptions, versus 13/24 under a fixed cap. Only 71 of 3,830 scanned MCP server and transport repositories expose any code-visible safeguard proxy, and none cover all four safeguard families. These results establish persistent billable state as a first-class security object and pre-reingestion as its host-owned control point.

Problem

• Denial-of-Wallet
• Tool-Calling LLM Agents
• Persistent Billable State
• Security

Innovation

• Denial-of-Wallet
• Persistent Billable State
• Tool-Calling LLM Agents
• History Transformation
• DOW-BENCH