A new attack makes AI agents send 93.88 times more calls
The attack keeps an AI agent at work after its task is complete, and the provider pays for the additional work.
Researchers made OverServe, an attack on AI agents that companies sell as a subscription service (SaaS). A malicious customer sends one prompt. The agent then checks a status again and again after its task is complete. The team measured a maximum of 93.88 times more calls to the provider API (the connection that software uses to get a service). The customer does not pay for this work.
How it works
The agent decides when to stop. OverServe gives the attacker a status tool and a prompt that tells the agent to make sure the work is complete. Each tool call gives a correct answer and ends correctly, but the agent checks again.
The numbers
The team tested the models Qwen, Nemotron, DeepSeek and Sonnet on tasks from nine benchmarks (standard tests). All runs gave correct results in the initial task checks. The tool specifications gave no warning in the scanners that the team tested. The 93.88 times figure is the maximum, not the average.
What is not known
The paper gives no average cost for a provider. It gives no defense. The team used selected tasks. Real services can give different results. real services can give different results.
Insight: Each step looks usual, so step checks miss it
The OverServe tools give correct answers and end correctly, and the tested scanners gave no warning. Cisco released Quarry in October 2026. Quarry examines a full agent session, because each step of an attack can look usual. This reads as a weak point: a check of single steps cannot find waste that shows only in a full session. Leaders who sell agents must monitor the cost of each session.
Sources
Posted
