Token cost amplification via context flooding
Attackers can craft content that causes AI agents to consume excessive tokens — by inserting large files, repetitive instructions, or recursive prompts that bloat the context window. This inflates API costs and can cause rate-limit denial of service.
Key facts
Token cost amplification via context flooding is a low-severity AI agent security threat targeting context window, model API costs, rate limits, agent response time. Keep Guard enabled for supported risky actions that can introduce unnecessary content, but do not rely on Guard as a token meter or context-window limiter. Use model-provider or harness token and context controls where those controls exist.
What happens
An attacker crafts content that causes the agent to consume excessive tokens — by embedding large base64 blobs, repetitive instructions, or recursive prompts that cause the agent to re-read the same files. This inflates API costs and can trigger rate limits.
How the attack unfolds
What it looks like in practice
A developer asks Claude Code to review a file that contains a 500KB base64-encoded "image". Claude reads the file, and the entire base64 blob enters the context window. On every subsequent turn, the blob is re-sent to the API, consuming 125K tokens per turn. After 10 turns, the developer has spent $50 on a single session.
Detection and Guard coverage
How to stop it
Keep Guard enabled for supported risky actions that can introduce unnecessary content, but do not rely on Guard as a token meter or context-window limiter. Use model-provider or harness token and context controls where those controls exist.
Related threat guides
Use the protections Guard supports here
Guard can review or block supported actions for this threat. The advisory above calls out what Guard covers and where other controls are still needed.