Threat T4

Resource Overload

Impact level: Medium
Risk score: 6/10 (High)
CIA impact: Availability
Affected components: External Environment Interface (KC6.1-KC6.3)
Tags: resources, denial-of-service, rate-limiting, costs, performance
Source: OWASP Agentic AI T&amp;M v1.1 (2025-12)

Overwhelming external services through excessive API calls or resource consumption, potentially causing denial of service or excessive costs.

Overview

How attackers carry out resource overload against an agentic system.

Attack vector	Severity	Example
API Rate Limit Exhaustion	Medium	Flooding external APIs with requests to cause service denial
Compute Resource Exhaustion	Medium	Overwhelming agent processing power with complex tasks
Memory Consumption Attack	Medium	Causing agent to consume excessive memory resources
Concurrent Task Flooding	High	Triggering multiple resource-intensive operations simultaneously
Cost Amplification Attack	Medium	Exploiting pay-per-use services to generate excessive costs
Feedback Loop Exploitation	Medium	Creating recursive operations that consume resources

Controls from the catalog that reduce the likelihood or impact of T4.

M2 Tool Sandboxing & Isolation
Implement defense-in-depth isolation for tool execution environments using containerization, virtualization, and strict resource controls to prevent tool misuse, contain breaches, and prevent unexpected code execution.
M9 Distributed Resource Management & Rate Limiting
Implement multi-layer resource controls with intelligent quotas, circuit breakers, cost management, and distributed rate limiting to prevent resource exhaustion, financial damage, and denial of service attacks while maintaining system performance.
M14 Runtime Security Controls & Sandboxing
Implement comprehensive runtime security controls including advanced sandboxing, execution monitoring, and dynamic security policy enforcement to prevent unexpected code execution and contain security breaches in real-time.