# Agent Resource Exhaustion Detection

- **Severity:** High
- **Signature ID:** `a795ed50-1d13-4cae-8c3f-73aa5f1f3a2d`
- **MITRE ATLAS:** AML.T0046 (Spamming AI System with Chaff Data), AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI05 (Cascading Failures in Multi-Agent Systems), LLM06 (Excessive Agency), LLM10 (Unbounded Consumption)

## Summary

This detects when an AI agent's actions or instructions could overwhelm a system by running unlimited queries, mass file operations, or spawning too many processes at once. It's a resource-exhaustion pattern, not a specific exploit or breach.

## How the attack works

An agent is given or generates a task involving bulk operations — for example a database query with no row limit, an instruction to iterate over all items in a large dataset, a batch job with no cap on size, or a command that forks or spawns many processes. Because the agent has broad permissions ('excessive agency'), it executes these unbounded operations directly. In multi-agent setups, one agent's runaway resource use can cascade and degrade or crash other agents relying on the same infrastructure. The rule looks for these patterns in the text of tool calls and agent outputs, such as SELECT * without LIMIT or mass-iteration language.

## Why it matters

Left unchecked, this can exhaust CPU, memory, disk, or database connections, slowing or crashing the affected system and any dependent agents or services — effectively a self-inflicted denial of service triggered through the agent rather than an external attacker.

## What you can do

- Enforce hard limits on query result sizes, batch sizes, and loop iteration counts at the application or database layer, not just in agent prompts.
- Restrict agents' default permissions so bulk or unbounded operations require explicit approval.
- Set resource quotas (CPU, memory, concurrent processes) per agent so one runaway task can't starve others.
- Review flagged events against known legitimate high-volume jobs (ETL, indexing) and allowlist those specifically instead of disabling the check broadly.

## Known benign look-alikes

- Authorized large-scale data processing or ETL pipeline agents
- Batch analysis tasks with expected high volume approved by admin
- Initial data ingestion or indexing operations with known high volume
- Database export operations authorized by data team
- Authorized ETL pipeline agent performing scheduled nightly full-table exports with pre-approved resource allocation
- Database migration tool copying entire tables during a sanctioned schema upgrade window

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00051

---
Source: https://www.netzilo.com/threats/atr-agent-resource-exhaustion-detection