Denial-of-wallet is a cost attack that forces a cloud or SaaS service to spend money faster than expected. An attacker sends repeated requests, triggers expensive compute, or exploits an API that scales with usage, creating bills instead of immediate technical damage. In pay-as-you-go environments, even small amounts of abuse can become expensive quickly.
This matters because cloud cost is a security boundary. A denial-of-wallet attack may accompany denial-of-service: the target is not only slowed down, but also billed for the workload. In modern AI and agentic systems, repeated retries, long tool chains, or inference loops can produce the same effect. Defenses include rate limits, quotas, spending alerts, per-tenant budgets, approval gates for high-cost actions, and strict limits on retries and concurrency. Good isolation and least privilege help keep one user or agent from draining shared resources.