OWASP LLM10 Unbounded Consumption: Testing YandexGPT Lite 5 and GigaChat Lite on Resource-Intensive Prompts
OWASP LLM10: Unbounded Consumption has emerged as a critical threat category in the OWASP Top 10 for LLM Applications. Unlike classic prompt injection or data leakage attacks, this class targets computational resources by forcing models to execute disproportionately expensive tasks.
Large language models now serve as primary interfaces in corporate assistants, RAG applications, AI agents, code generation, and document automation. As adoption grows, attackers increasingly craft single prompts that maximize token usage, context window pressure, and inference cost rather than stealing data or bypassing filters.
The research tested two leading Russian models — YandexGPT Lite 5 and GigaChat Lite — using the AI Red Team platform containing over 200 resource-consumption prompts. Attack classes included Quine-like recursion, fractal nesting, computational explosion, semantic superposition, multi-agent simulation, and glitch-token abuse.
YandexGPT Lite 5 employed multiple strategies: strict 512-token output limits, explicit refusals with scope reduction suggestions, and semantic degradation that preserved usefulness while avoiding full materialization of repetitive or exponential content. In several cases the model recognized excessive scale before expensive generation began.
GigaChat Lite consistently attempted to reduce task scope rather than refuse outright. It answered questions about calculating pi by explaining the method instead of emitting millions of digits and handled large graph problems by describing algorithms rather than enumerating all Hamiltonian cycles.
Both models demonstrated graceful degradation that limits resource expenditure while retaining informative value. The study was conducted with support from the Foundation for Assistance to Innovations and provides concrete prompt examples solely for research and defensive development purposes.
Related articles
Microsoft Copilot Abused to Accelerate Corporate Account Takeovers and Bank Transfer Frauds
Cybercriminals can leverage Microsoft Copilot to speed up the compromise of corporate accounts and execute financial frauds. In a controlled simulation, researchers demonstrated how the AI assistant helped redirect a $247,500 bank transfer after gaining access to an employee's email. The attack begins with the creation of inbox rules that automatically delete suspicious login alerts, followed by rapid analysis of internal communications to identify high-value targets. Copilot was then used to replicate the victim's writing style and craft a convincing phishing email capable of stealing session tokens and bypassing multi-factor authentication. Once the executive account was taken over, the tool quickly located pending payments and generated a fraudulent request to alter the recipient bank details. The scenario highlights risks from legitimate AI features rather than any specific vulnerability in Copilot itself.
Vibe Hacking Rises: Generative AI Lowers Barriers for Offensive Security Operations
Generative AI is reshaping the cybersecurity threat landscape by dramatically reducing the cost of offensive security knowledge. Previously, attackers needed years of experience in reverse engineering and exploit development to conduct meaningful intrusions, but AI now assists with research, code generation, debugging, and adapting known techniques to new environments. This enables less experienced individuals to build functional attack chains in weeks rather than years. The article introduces the concept of vibe hacking, where attackers collaborate with AI assistants using natural language prompts in a process similar to vibe coding. Defenders can no longer rely on the scarcity of skilled adversaries and must shift toward continuous validation frameworks such as CTEM, AEV, and PTaaS. Senior human experts remain essential for risk judgment and business context, even as automation accelerates routine tasks.
Hunt.io Exposes Suspected Chinese Cyber Espionage Operation Using Agentic LLMs Claude Code and DeepSeek
In July 2026 Hunt.io published research on a suspected Chinese cyber espionage campaign uncovered through an exposed directory on a Hong Kong server. The leak contained 2,431 files including victim source code, operation logs, web shells, exploitation scripts, scan results and phishing page clones. Researchers identified traces of Claude Code and DeepSeek-v4-pro working together, with Claude Code handling agentic tasks and session context while DeepSeek supported reasoning, script refinement and next-step selection. The infrastructure cluster, known as TencShell, showed overlapping SHA-256 HTTP headers, SSH host keys and TLS certificates across 13 IP addresses. Multiple initial access vectors were observed, including SQL injection against Taiwanese and Thai government targets plus exposure of Supabase and Azure secrets. The report also references a parallel Anthropic disclosure on GTG-1002, another Chinese state-linked operation that used Claude Code for 80-90 percent of tactical work.
DeepSeek-Powered Telegram Bot Attempts Autonomous Attacks on 460 Targets but Achieves Zero Successes
Researchers from Unit 42 at Palo Alto Networks recovered the full activity log of an autonomous AI agent built with the Hermes Agent framework and the DeepSeek model. The agent scanned the internet for targets, downloaded public exploits, evaluated vulnerabilities such as CVE-2026-33017 in Langflow and a pair of flaws in n8n, and attempted exploitation without any human intervention. Despite processing hundreds of hosts, the autonomous loop failed to compromise a single system because required configurations were absent on the victim servers. Parallel manual operations conducted by the same actor using traditional tools succeeded against three Citrix NetScaler instances and eleven Marimo deployments. The operator, assessed to be based in Zhuhai, China, relied on Telegram as the command channel and lost operational security when the agent exposed its home directory containing logs and API keys. The case demonstrates both the current limitations of LLM-driven attack agents and the low barrier to entry created by open-source agent frameworks paired with permissive models.