Beyond Max Tokens: Stealthy Resource Amplification via Tool Calling Chains in LLM Agents

TL;DR

This paper introduces a stealthy, multi-turn attack method that exploits tool calling chains in LLM agents to significantly increase resource consumption without detection, revealing vulnerabilities in current agent defenses.

Contribution

The paper presents a novel multi-turn economic DoS attack at the tool layer using text-only edits optimized by MCTS, demonstrating substantial resource amplification in LLM agents.

Findings

Increases per-query cost by up to 658 times

Raises energy consumption by 100 to 560 times

Pushes GPU KV cache occupancy to 35-74%

Abstract

The agent--tool interaction loop is a critical attack surface for modern Large Language Model (LLM) agents. Existing denial-of-service (DoS) attacks typically function at the user-prompt or retrieval-augmented generation (RAG) context layer and are inherently single-turn in nature. This limitation restricts cost amplification and diminishes stealth in goal-oriented workflows. To address these issues, we proposed a stealthy, multi-turn economic DoS attack at the tool layer under the Model Context Protocol (MCP). By simply editing text-visible fields and implementing a template-driven return policy, our malicious server preserves function signatures and the terminal benign payload while steering agents into prolonged, verbose tool-calling chains. We optimize these text-only edits with Monte Carlo Tree Search (MCTS) to maximize cost under a task-success constraint. Across six LLMs on ToolBench and BFCL benchmarks, our attack yields trajectories over 60K tokens, increases per-query cost by up to 658 times, raises energy by 100 to 560 times, and pushes GPU key-value (KV) cache occupancy to 35--74%. Standard prompt filters and output trajectory monitors seldom detect these attacks, highlighting the need for defenses that safeguard agentic processes rather than focusing solely on final outcomes. We will release the code soon.