# DoS: Forced Infinite / Maximum-Length Output Token Flood

- **Severity:** High
- **Signature ID:** `f9f89d16-8732-446d-a5e5-e1092eb193a7`
- **MITRE ATLAS:** AML.T0040 (AI Model Inference API Access), AML.T0046 (Spamming AI System with Chaff Data)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM10 (Unbounded Consumption)

## Summary

This detects prompts that instruct an AI system to generate as much text as it possibly can, filling its entire output window or running until it hits its token limit. The goal is to make each request cost the operator as much compute time and money as possible.

## How the attack works

An attacker sends a prompt containing an explicit instruction like 'generate as much text as possible', 'fill your entire output window', or 'write until you run out of tokens'. Unlike asking the model to repeat a word many times, this attack does not need a specific count or target string — it just asks for maximum length. The model, if it complies, produces the longest response it is capable of, consuming the full token budget for that single request. Repeated at scale, these requests drive up compute cost and can degrade service for other users.

## Why it matters

The operator pays for wasted compute and inference time on responses that have no real purpose, and legitimate users may see slower responses or hit rate limits because capacity is tied up serving inflated outputs.

## What you can do

- Set hard per-request output token caps that cannot be overridden by user instructions.
- Monitor for a pattern of requests that consistently hit the maximum output length, and rate-limit or flag accounts that repeat this pattern.
- Distinguish attack prompts from legitimate 'write comprehensively about X' requests by checking whether the user provides a topic that reasonably justifies a long answer.
- Alert on and review any system or agent-level instructions that could be hijacked to remove existing output length limits.

## Known benign look-alikes

- Security documentation describing token-flood attacks
- Legitimate 'write as much as you know about X' requests where the user wants comprehensive coverage

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01760

---
Source: https://www.netzilo.com/threats/atr-dos-forced-infinite-maximum-length-output-token-flood