Versatile AI Risk Assessment

AI threat catalogue Attacks on the Running Model and Service Production

Cost Harvesting / Repurposing

Attackers use a company's paid AI services without authorisation and at its expense, for example with stolen access keys. The costs and the load fall on the owner.

As of: October 2026 · Catalogue version 2026.10.24.2 · 5 mitigations · 5 verified sources

Description

Paid AI services are billed by usage. Attackers gain access to the account or the API key, for example through stolen credentials or keys accidentally published in code, and run their own workloads through it. Reselling the access to third parties via an intermediary proxy is also common. One variant aims solely at driving up costs through massive usage (denial of wallet). Unlike a pure overload attack, the goal is co-opting the service at someone else's expense or causing financial harm, not an outage.

Possible impact

The company faces unexpected and sometimes substantial cloud and compute costs. The unauthorised access may also violate terms of use or be misused to generate harmful content, which is charged back to the owner's account. Finances, operations and, indirectly, reputation are affected.

Example

A developer accidentally uploads an API key to a public code repository. Within hours strangers use the key to run their own requests through the company's AI service; at the end of the month the bill runs to several thousand euros.

Recommended mitigations (5)

Compare effects and implementation levels. Expand each entry for the additional classification and rationale.

  • API key rotation and secrets management

    Technical
    Effect
    Preventive
    Implementation level
    Application, API & agents, Infrastructure
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: Machine-enforced identity, permission, or scope rules constrain unauthorized access and actions; complemented by binding workflows.

  • Usage anomaly detection

    Technical
    Effect
    Detective
    Implementation level
    Application, API & agents, Use & operations
    Classification and rationale

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.

  • Spending limits and alerts

    Technical
    Effect
    Preventive, Detective, Impact-limiting
    Implementation level
    Application, API & agents, Use & operations
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: Automated resource controls, budget limits, or runtime boundaries constrain overload, abuse, cost, and cascading failures; complemented by binding workflows.

  • IP allowlisting

    Technical
    Effect
    Preventive
    Implementation level
    Application, API & agents, Infrastructure
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: Machine-enforced identity, permission, or scope rules constrain unauthorized access and actions; complemented by binding workflows.

  • Audit logs for API usage

    Technical
    Effect
    Detective
    Implementation level
    Application, API & agents, Use & operations
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators; complemented by binding workflows.

Framework mappings

Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.

OWASP LLM Top 10 LLM06:2026MITRE ATLAS AML.T0034EU AI Act Article 26(5) · Article 55(1)(d) · Article 9(1), 9(2)(a), 9(2)(d)

Verified references (5)

Every reference states the framework, the exact location and the publishing organisation.

EU AI Act obligations related to this threat

The obligations from the obligations compass whose articles the catalogue maps to this threat. Each leads to its entry with core, action step and evidence; whether it applies to you depends on role and risk class.

  • Establish and operate a risk management system Art. 9 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028

    Statutory roles: Provider, Product manufacturer. Classes: High-risk under Annex III, High-risk as a product or safety component.

    This reference is a review prompt. A threat match alone does not establish applicability.

  • Monitor operation and suspend on risk Art. 26 Abs. 5 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028

    Statutory roles: Deployer. Classes: High-risk under Annex III, High-risk as a product or safety component.

    This reference is a review prompt. A threat match alone does not establish applicability.

  • Evaluate and mitigate systemic risks Art. 55 · applies from 2 August 2025

    Statutory roles: Provider of a general-purpose AI model. Classes: Model with systemic risk.

    This reference is a review prompt. A threat match alone does not establish applicability.

All 62 obligations by role, risk class and deadline in the obligations compass

More entries from the topic group Attacks on the Running Model and Service.

Model Theft Attackers create a working copy of a proprietary AI model, either by querying it at scale or by breaking into the infrastructure. Adversarial Inputs Attackers alter an input in a way that is minimal and imperceptible to humans, so that the AI model classifies it incorrectly. Model Denial of Service Attackers overload the AI model with especially expensive requests until the service slows down or fails.

Matching use cases

This list shows where to review this threat, rather than how high the risk is.

Particularly important for:

  • Customer service chatbots and voicebotsThe bot requires no login and calls a paid language model for every message. Large volumes of automated requests drive up costs or exploit the bot as free model access.

Typical for:

For 44 further use cases, relevance depends on the system design, for example whether it incurs costs with each query or is also available to people outside your organisation. Show these use cases

Frequently asked questions

What is Cost Harvesting / Repurposing?
Attackers use a company's paid AI services without authorisation and at its expense, for example with stolen access keys. The costs and the load fall on the owner.
Which mitigations help against Cost Harvesting / Repurposing?
The catalogue lists 5 mitigations, each with control type, effect and implementation level. First among them are API key rotation and secrets management, Usage anomaly detection and Spending limits and alerts.
Which EU AI Act obligations does Cost Harvesting / Repurposing touch?
The catalogue maps this threat to Art. 9, Art. 26 Abs. 5 and Art. 55 of the EU AI Act. In the obligations compass this leads to: Establish and operate a risk management system, Monitor operation and suspend on risk and Evaluate and mitigate systemic risks. Whether an obligation applies depends on role, risk class and deadline.

Assess this threat in your own system

The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.

Start the live demo See the free modules

Cite this entry

For reports, policies or internal documents; the link leads directly to this entry.

“Cost Harvesting / Repurposing”. Versatile AI Risk Assessment, AI threat catalogue, as of October 2026.
https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/cost-harvesting/

← Back to the full catalogue