Researchers show how a customer can make a SaaS AI agent burn the provider's resources

A cost hiding in the subscription model

Many software companies now let AI agents, meaning models that can take actions on their own, handle longer business workflows. Under a flat subscription, each model call and tool call costs the provider money, but the customer pays nothing extra for it.

As arxiv.org reported, a paper called OverServe shows how a malicious customer, called a tenant, could turn that arrangement against the provider.

How the trick works

The agent decides on its own when it is finished. The attacker uses a prompt that exploits that decision and pushes the agent to keep going.

The attack pairs two pieces. One is a status tool built on the Model Context Protocol (MCP), a standard way of plugging tools into agents. The other is a prompt asking the agent to confirm that the work is complete.

Every status call returns accurate information and ends normally. But the agent may keep checking a condition that is still unfinished in order to satisfy the prompt. The provider's resources keep being used even after the real business task is done.

What the tests found

OverServe is a multi-agent framework, meaning several AI agents work together to build these attacks. It builds tool-and-prompt pairs for a specific service. Separate reviews of the tool and the prompt help it choose the best candidates.

The authors tested with Qwen, Nemotron, DeepSeek and Sonnet on selected tasks from nine benchmarks. Every run passed the original task checks, so the agent still did what the customer asked.

In the best case, API requests were amplified by 93.88 times. The tool specifications also raised no alerts in the MCP scanners the authors evaluated.

Caveats

This is an early paper posted on arXiv, a site where researchers share work before peer review. The abstract does not say how common the attack would be against real products, or how a provider might defend against it.