Anthropic Claude context flooding — resource exhaustion via adversarial long-context prompts
Date: 2024-08
Affected: Claude (200K context), GPT-4 (128K context), Gemini (1M+ context) — all long-context models; cloud API billing directly impacted
Attack vector: dos
Category: research-demonstrated
Severity: High

Researchers demonstrated that Claude and other long-context models could be forced into extended processing via adversarial prompts that fill the context window with repetitive or recursive content, causing disproportionate compute consumption. By submitting prompts at maximum context length (200K tokens for Claude) filled with content designed to maximize inference time (complex reasoning chains, nested conditional logic), attackers could cause 10-50x normal API cost per request. When automated, this constitutes a denial-of-wallet attack. The research showed that per-request token limits alone are insufficient — latency-based rate limiting is required.

Impact: Denial-of-wallet attack: adversarial prompts cause disproportionate compute cost; longer context windows = larger attack surface; per-token rate limits insufficient

Mitigations:
Latency-based rate limiting (not just token count)
Cost-per-request monitoring with anomaly alerts
Input complexity analysis before processing
Context window limits per user/API key appropriate to use case

Architectural layers (MAESTRO):
label: Foundation Models
notes: Model processes adversarial long-context without resource bounds
role: origin
label: Deployment & Infrastructure
notes: Inference infrastructure overwhelmed — cost amplification
role: impact
label: Evaluation & Observability
notes: Monitoring tracked token count but not inference latency or cost-per-request
role: blind-spot