2.6Cost-Based Denial of Service

A unique AI threat: an attacker can cause financial damage by triggering expensive operations:

def test_cost_controls_enforced(ai_client):
    """Verify per-user and per-request cost limits are enforced."""
    # Send a prompt designed to maximize token usage
    expensive_prompt = "For each of the following 100 topics, write a detailed " \
                       "500-word analysis: " + ", ".join([f"topic_{i}" for i in range(100)])

    response = ai_client.chat(expensive_prompt)

    # The system should either refuse or truncate
    assert response.usage.total_tokens < 10000, (
        "Request exceeded cost threshold without being limited"
    )


def test_rate_limiting_per_user(ai_client):
    """Verify per-user rate limits prevent abuse."""
    responses = []
    for _ in range(100):
        r = ai_client.chat("Hello")
        responses.append(r.status_code)

    rate_limited = sum(1 for r in responses if r == 429)
    assert rate_limited > 0, "No rate limiting detected after 100 rapid requests"