mlsanityData to 14 Oct 2026

Beyond Max Tokens: Stealthy Resource Amplification via Tool Calling Chains in LLM Agents

arXiv 2601.10955 ↗First posted 16 Jan 2026cs.CR cs.AIcited by 14

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

The agent--tool interaction loop is a critical attack surface for modern Large Language Model (LLM) agents. Existing denial-of-service (DoS) attacks typically function at the user-prompt or retrieval-augmented generation (RAG) context layer and are inherently single-turn in nature. This limitation restricts cost amplification and diminishes stealth in goal-oriented workflows. To address these issues, we proposed a stealthy, multi-turn economic DoS attack at the tool layer under the Model Context Protocol (MCP). By simply editing text-visible fields and implementing a template-driven return policy, our malicious server preserves function signatures and the terminal benign payload while steering agents into prolonged, verbose tool-calling chains. We optimize these text-only edits with Monte Carlo Tree Search (MCTS) to maximize cost under a task-success constraint. Across six LLMs on ToolBench and BFCL benchmarks, our attack yields trajectories over 60K tokens, increases per-query cost by up to 658 times, raises energy by 100 to 560 times, and pushes GPU key-value (KV) cache occupancy to 35--74%. Standard prompt filters and output trajectory monitors seldom detect these attacks, highlighting the need for defenses that safeguard agentic processes rather than focusing solely on final outcomes. We will release the code soon.

Key facts. Cited by 14 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 37 of its 74 references that are in the map. First posted on arXiv 16 Jan 2026.

Builds on

37 of 74 references.

Closest ancestors · 6

Same direction, newest first

  1. 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures24 Jun
  2. 2025A Survey of Attacks on Large Language Models18 May
  3. 2025MPMA: Preference Manipulation Attack Against Model Context Protocol16 May
  4. 2025A survey of agent interoperability protocols: Model Context Protocol (MCP), Agent Communication Protocol (ACP), Agent-to-Agent Protocol (A2A), and Agent Network Protocol (ANP)4 May
  5. 2024Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification30 Jul
  6. 2024AutoDefense: Multi-Agent LLM Defense against Jailbreak Attacks2 Mar

Other references · 31

  1. 2024The Llama 3 Herd of Modelscited by 14,715
  2. 2023Efficient Memory Management for Large Language Model Serving with PagedAttentioncited by 5,944
  3. 2023The Rise and Potential of Large Language Model Based Agents: A Surveycited by 1,439
  4. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  5. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  6. 2023Detecting Language Model Attacks with Perplexitycited by 431
  7. 2025Multi-Agent Collaboration Mechanisms: A Survey of LLMscited by 431
  8. 2023Power Hungry Processing: Watts Driving the Cost of AI Deployment?cited by 191
  9. 2023From Words to Watts: Benchmarking the Energy Costs of Large Language Model Inferencecited by 170
  10. 2025AI Agents vs. Agentic AI: A Conceptual Taxonomy, Applications and Challengescited by 169
  11. 2025Qwen3Guard Technical Reportcited by 155
  12. 2025Evaluation and Benchmarking of LLM Agents: A Surveycited by 152
19 more
  1. 2025OWL: Optimized Workforce Learning for General Multi-Agent Assistance in Real-World Task Automationcited by 131
  2. 2025OverThink: Slowdown Attacks on Reasoning LLMscited by 96
  3. 2024Coercing LLMs to do and reveal (almost) anythingcited by 89
  4. 2025A Survey of AI Agent Protocolscited by 81
  5. 2024Inducing High Energy-Latency of Large Vision-Language Models with Verbose Imagescited by 69
  6. 2025Model Context Protocol (MCP) at First Glance: Studying the Security and Maintainability of MCP Serverscited by 65
  7. 2024Agents in Software Engineering: Survey, Landscape, and Visioncited by 60
  8. 2025KVFlow: Efficient Prefix Caching for Accelerating LLM-Based Multi-Agent Workflowscited by 56
  9. 2025AlphaAgent: LLM-Driven Alpha Mining with Regularized Exploration to Counteract Alpha Decaycited by 42
  10. 2025Multi-Agent Coordination across Diverse Applications: A Surveycited by 37
  11. 2024Hype, Sustainability, and the Price of the Bigger-is-Better Paradigm in AIcited by 35
  12. 2024Denial-of-Service Poisoning Attacks against Large Language Modelscited by 35
  13. 2024Crabs: Consuming Resource via Auto-generation for LLM-DoS Attack under Black-box Settingscited by 35
  14. 2025From Mind to Machine: The Rise of Manus AI as a Fully Autonomous Digital Agentcited by 33
  15. 2025MCPToolBench++: A Large Scale AI Agent Model Context Protocol MCP Tool Use Benchmarkcited by 32
  16. 2024An Engorgio Prompt Makes Large Language Model Babble oncited by 30
  17. 2025MathAgent: Leveraging a Mixture-of-Math-Agent Framework for Real-World Multimodal Mathematical Error Detectioncited by 24
  18. 2025Why Multi-Interest Fairness Matters: Hypergraph Contrastive Multi-Interest Learning for Fair Conversational Recommender Systemcited by 5
  19. 2025Limits to AI Growth: The Ecological and Social Consequences of Scalingcited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 14.

14 papers.

Sort:

By area:

  1. 2026Clawdrain: Exploiting Tool-Calling Chains for Stealthy Token Exhaustion in OpenClaw Agentscited by 14
  2. 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluationcited by 7
  3. 2026Overthinking Loops in Agents: A Structural Risk via MCP Toolscited by 5
  4. 2026Resource Consumption Threats in Large Language Modelscited by 2
  5. 2026Data Agents Under Attack: Vulnerabilities in LLM-Driven Analytical Systemscited by 2
  6. 2026Convergent Detour Hijacking: Task-Preserving Resource Amplification in Skill-Based LLM Agentscited by 2
  7. 2026From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrailscited by 1
  8. 2026Overthink-Triggered Slowdown Attacks on LVLM-Based Robotic Systemscited by 0
  9. 2026Beyond Direct Access: Resource Hijacking in LLM Agentscited by 0
  10. 2026AEGIS: Preventing Cross-Domain Resource Abuse in MCPcited by 0
  11. 2026SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agentscited by 0
  12. 2026Ask the Tool, Don't Guess: Agent Tool Calls Hold Their Progress, and the Serving System Should Read Itcited by 0
2 more
  1. 2026When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systemscited by 0
  2. 2026Persistent Billable State: Denial-of-Wallet Attacks and Defenses in Tool-Calling LLM Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025MCP Security Bench (MSB): Benchmarking Attacks Against Model Context Protocol in LLM Agents
  2. 2025Les Dissonances: Cross-Tool Harvesting and Polluting in Pool-of-Tools Empowered LLM Agents
  3. 2025Attack the Messages, Not the Agents: A Multi-round Adaptive Stealthy Tampering Framework for LLM-MAS
  4. 2025Attractive Metadata Attack: Inducing LLM Agents to Invoke Malicious Tools
  5. 2026PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents
  6. 2026ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection
  7. 2024From Allies to Adversaries: Manipulating LLM Tool-Calling through Adversarial Injection
  8. 2025The Dark Side of LLMs: Agent-based Attack Vectors for System-level Compromise