Persistent Billable State: Denial-of-Wallet Attacks and Defenses in Tool-Calling LLM Agents

Reported by arXiv cs.CR (Jinqian Zhang (Institute of Information Engineering, Chinese Academy of Sciences, School of Cyber Security, University of Chinese Academy of Sciences), Haojun X)

Summary by Cyber Security News25 Sep 2026, 06:00 CEST

About this summary. This is a short, independently written summary of an article first published by arXiv cs.CR. Cyber Security News did not report or verify the underlying story. Read the original: https://arxiv.org/abs/2609.28585

arXiv:2609.28585v1 Announce Type: new Abstract: Multi-step tool-calling LLM agents rely on host runtimes to preserve state across turns. When a runtime carries an external tool return into later model inputs, providers meter it again. An admitted malicious or compromised tool can thereby convert untrusted data into recurring victim-billed processing without victim credentials or local runtime privilege.

Read the full article at arXiv cs.CR →

Source attribution: headline and facts are from arXiv cs.CR (arxiv.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

SLED-IFV: Solver-Validated LLM-Guided Decomposition for Scalable Hardware Information-Flow Verification

Runtime Authorization Consistency Checking for MCP-based Agentic Workflows

ShinyHunters tells The Reg: We hacked the FBI to 'protect our business'

Secure AI Adoption: Close the Governance Gap to Accelerate AI in the Cloud

ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft

From Opus 5 to Opus 5.5: better fixes at 58% less cost in the SonarQube Remediation Agent