Your agent can be turned into a denial-of-service weapon against your own bill

The attack

In a preprint posted this week, researchers describe OverServe, a new class of resource amplification attack aimed at autonomous software-as-a-service agents. The trick manipulates the interaction between tool status reports and completion-confirmation prompts, forcing agents to repeatedly check unfinished conditions and inducing large volumes of unauthorized API requests without triggering standard security alerts. The researchers report up to 93.88 times API request amplification while preserving the original task goal. The agent keeps doing its job; it just does it dozens of times more expensively than it should. m:…9322

The uncomfortable part is what does not catch it. Current MCP scanners fail to detect OverServe-style tool-prompt pairs, according to the preprint, and SaaS agents are vulnerable to resource exhaustion attacks in which malicious tenants exploit agent autonomy to extend execution time. This is not a prompt-injection story about making the agent do something evil. It is about making the agent do something ordinary, over and over, until the bill or the service falls over. The attacker does not need to break in; they need to keep the agent busy. m:…9322

The defenses arriving with it

Three other preprints this week offer defenses that work on different layers of the same problem. One introduces intent-aware protection, treating an agent's intended purpose as a security object rather than relying on pattern matching or permission checks. By defining an Intent Profile, the framework detects intent drift, where an agent acts within its technical permissions but violates its operational role. Intent Profile-based post-execution detection achieves 0.949 AUROC on AgentDojo trajectories, and input alignment using the profile improves protection success by 7 points over DataFilter. The idea is simple: knowing what the agent was supposed to do is more useful than knowing what it was allowed to do. m:…9750

A second preprint, CapLite, tackles small language model agents, which are unreliable at writing their own security artifacts. Small models from 1.7B to 12B parameters fail against attacks with existing defenses like Progent and IPIGuard on most models, according to the researchers. CapLite instead derives security policies directly from tool schemas and enforces strict argument validation before tool execution. It achieves zero attack success across 13,935 AgentDojo episodes while maintaining utility comparable to state-of-the-art methods, and requires only 18 percent of the tokens used by CaMeL. For teams running small models at the edge or in cost-sensitive deployments, that token saving matters as much as the security result. m:…9747

The third strand is about how security gets measured at all. MobileProbe, a trajectory-aware red-teaming framework for mobile agents, shows that fixed-point benchmarks underestimate security risks because they fail to account for varying agent trajectories and lack test coverage for pages the agent never reaches. Environmental injection attacks pose a significant risk to mobile GUI agents because agents act on screen content, allowing attackers to embed malicious instructions. MobileProbe achieves higher attack success rates than human-written, zero-shot LLM and prior automated red-teaming baselines. Separately, RAS-Eval argues that LLM-as-a-Judge and Agent-as-a-Judge methods are vulnerable to hallucination and perturbations, producing unreliable security verdicts on long-horizon tasks, and instead uses Linear Temporal Logic to express security objectives for deterministic verification of tool-call trajectories. It detects transient violations that textual log-based evaluation often misses. m:…9746 m:…9729

What operators should do

The practical read is that agent security has moved past the prompt filter. OverServe shows the bill itself is an attack surface, and the scanners teams already run do not see it. The defenses that look most useful check the agent's intent, validate arguments against tool schemas before execution, and measure security along the agent's actual trajectory rather than a fixed script. None of these preprints is peer-reviewed, and their numbers come from their own benchmarks, so treat the headline figures as the authors' claims, not settled fact. But the direction is consistent: the teams that will survive agentic deployment are the ones that watch what their agents are doing, how often, and at whose expense, not just what they are allowed to say. m:…9322 m:…9750 m:…9747 m:…9746