A compromised tool can quietly turn your AI agent into a recurring bill generator, researchers warn.
New research examines tool-calling AI agents, the kind that fetch data from outside services and feed it back into later prompts. The study describes six ways a malicious or compromised tool can make that retained data get billed again and again, without ever touching the victim's credentials. Testing across six model families and 243 runs, the researchers found the priciest sessions ballooned to 14,293 times the cost of their first call. Simply keeping raw tool history around, rather than trimming it, pushed average costs up by 21 to 36 percent, while a compression-based fix worked on 10 of 12 history-dependent tasks versus just 2 of 12 for outright deletion.
This is an old idea in new clothes: denial-of-wallet attacks have drained cloud budgets for years by triggering excessive API calls. Applying the same logic to an LLM's context window means the attack surface now includes anything an agent is allowed to read, not just what it's allowed to do. The researchers scanned 3,830 MCP server and transport repositories and found only 71 with any visible safeguard, and none covered all four protections they recommend.
Prompt injection gets the headlines, but a slow leak in your API bill is the kind of exploit nobody notices until finance does.