Originally published as part of VerifyClaw's internal security research into LLM-facing attack surfaces — adapted here for a general audience.
Resource exhaustion and context pressure attacks don't rely on the model doing anything unsafe with its output — they rely on the cost of processing the input or producing the output. A crafted prompt that consumes an unusually large share of the context window, or reliably induces long generations, degrades a system's latency, throughput, or availability without containing a single word a content filter would flag.
Why it matters for MCP agents
This category sits outside anything a semantic or grammar scanner is designed to catch, because there's no malicious content to detect — the size and shape of the request are the whole attack. A shared-infrastructure MCP server processing untrusted skill inputs is exposed to this the same way any public endpoint is exposed to oversized requests.
How we study it
The controlled comparison holds model, backend, thread count, and context capacity fixed, and measures prompt tokens, generated tokens, and elapsed time separately from baseline capacity checks — with any auxiliary work (like candidate scoring) reported independently, since it adds cost that a production request wouldn't otherwise pay. None of this is a clean production benchmark by itself; it's a way to characterize how much worse one input condition is relative to another, under identical conditions.
Related reading
Rate limits and per-request size caps are infrastructure controls, not scanner findings — but a scan can still tell you if a skill's design invites this.