Excessive Queries
Sub-technique of AML.T0034 Cost Harvesting
Description
Adversaries may send an excessive number of otherwise normal or low-complexity queries to an AI system with the goal of overwhelming its capacity and increasing operating costs.
The attacker can automate high-volume request generation, exploiting rate limits, autoscaling policies, and pay-per-use billing models to drive sustained resource consumption without relying on specially crafted, computationally expensive inputs. This behavior can also lead to increased latency, request queuing, and service degradation or unavailability for legitimate users, as the system struggles to process the inflated traffic.
- ATLAS ID
- AML.T0034.000
- Maturity
- FeasibleShown to be possible in principle (proof of concept).
- Platforms
- Predictive AIGenerative AIAgentic AI
Mitigations
- AML.M0035AI Red Team
Generate controlled high-volume query activity. Verify authentication, user and tenant quotas, rate limits, anomaly detection, cost alerts, and service protection.
Case studies that use it
No ATLAS case study records this technique yet. Browse all case studies.