A tool returns something. Your host keeps it in the conversation so the next turn has context. From then on the provider meters it again on every call — and that is the whole attack. An admitted, schema-valid return carrying bulk content plus a plausible reason to call another tool turns untrusted data into recurring, victim-billed processing, with no stolen credential and no local privilege. Across 243 executions the worst session re-billed 14,293× its own first call, 51 of 69 priced attack sessions crossed a ten-cent breaker, and simply keeping raw history rather than compressing it raised mean session cost by 21.2–35.9%. Of 3,830 public tool-server repositories scanned, 71 carried any visible safeguard.
Tool-call security usually stops at admission: is this server allowed, is this schema valid, is this content safe to act on. The paper’s point is that a second decision follows and almost nobody makes it deliberately — whether, and in what form, the return enters the next billable prompt.
Call that retained content persistent billable state. A return admitted once at turn one is reconstructed into the input of turn two, turn three and every turn after. Step the session forward and watch what the meter sees.
The shape is the finding: cost grows with the square of session length even when the payload never grows. Around a hundred and seventy turns of constant-size returns reproduces the paper’s worst measured amplification on arithmetic alone — no cleverness required, just a chatty tool and a long loop.
All six evaluated vectors use the same ordinary tool-return interface and the same attacker privileges. Only the amplification strategy changes, and each aims at a different host-metered resource: the input mass you retain, the output the model is induced to generate, or the recursive opportunity the session hands back.
The adaptive one is the reason a single threshold fails on its own. It treats the session as a feedback channel: start conservative, read continued tool use as evidence the last payload stayed under your guardrail, then creep up while preserving a margin. It trades peak one-turn pressure for a longer recursive lifetime — exactly the deal a cap on one signal offers.
The obvious mitigation is to stop carrying history. The paper runs it as a controlled three-way on the same tasks with the same models: keep every tool return raw, delete them, or transform them deterministically into a compressed form.
Deleting history is cheap and breaks the work: on tasks that genuinely need an earlier turn it completes 2 of 12 per provider, against 10 and 11 of 12 under compression. Continuity and cost-bearing mass are separable. What the next turn needs is the facts, not the bytes.
Every strategy above has to consume one of four host-metered resources: absolute prompt mass, turn-over-turn growth, recursive opportunity, or cumulative priced spend. So the defence is four invariants, one per resource, all enforced before the next provider call and none needing a provider-private hook.
Pick a vector, then switch invariants off and watch which one binds it first.
Fixed presets contain everything recorded — all 41 recurring attacks, under each of three threshold settings, across the 123-evaluation replay corpus. A fixed cap is also where the utility goes: on a 24-workflow transfer a flat ten-cent ceiling completed 13 of 24 and interrupted 9 before completion, while the same ceiling made extendable by host-verified evidence of progress completed 22 of 24 with zero pre-completion interruptions, at a mean cost of $0.113 against $0.099.
And the state of the ecosystem: of 3,830 public tool server and transport repositories scanned by source inspection, 71 contain any code-visible safeguard proxy. Sixty-seven of those cover exactly one of the four families. None cover all four.
You do not need an attacker for most of this. A well-meaning tool that returns a full page of JSON on every call, inside a loop your agent runs forty times, is buying the same quadratic. Set the payload and the session length and price it.
Turn count, not payload size, is what makes this quadratic — which is why capping consecutive tool turns is a cost control as much as a security one, and why the fix that actually changes the shape is transforming the return before it becomes the next prompt.