The paper identifies a new class of security vulnerability in multi-step tool-calling LLM agents: Denial-of-Wallet (DoW) attacks. In such systems, tool returns are preserved across turns to maintain state, but each time that state is fed into a model call it is billed again. A malicious or compromised tool can exploit this by returning inflated content that gets repeatedly processed, driving up costs or exhausting session budgets. The authors formalize this as persistent billable state and the host's decision boundary over whether to reintroduce tool returns into later model calls.
To study the threat, the authors derive six attack vectors and build DoW-Bench, an evaluation harness spanning six model families. Across 243 executions, they find that cumulative input tokens can balloon to over 14,000 times the initial call's input. Comparing history management strategies, retaining raw history increases mean session cost by 21.2–35.9%, while compression preserves task success far better than deletion (10–11 out of 12 tasks versus 2 out of 12). The paper also proposes a defense framework combining deterministic history transformation with four host-side invariants that bound prompt mass, context growth, recursive opportunity, and cumulative spend.
The work is significant because it uncovers an economic attack surface distinct from semantic manipulation, and provides principled, evaluated defenses. A survey of over 3,800 MCP repositories reveals that almost none implement such safeguards, highlighting a widespread gap in current agent runtime security.