Slide 12 of 28
Part 2 · How It WorksSlide 12
Slide 12 · Cost Amplification
The API does the work. The owner pays the bill.
When every request triggers a paid third-party operation, rate limits are a financial necessity.
How it works

Many APIs trigger operations that have a per-use cost: sending an SMS, running an AI model, encoding a video, sending an email, making a payment processor call. If the API charges nothing for these calls (or the per-use cost is lower than the third-party cost), an attacker can send requests until the bill is catastrophic.

Common expensive API operations
SMS OTP verification — ~$0.01 per message
AI image generation — $0.01–$0.04 per image
AI text inference (large models) — $0.001–$0.10 per call
Email delivery via Sendgrid/SES — $0.001 per email
Video transcoding — $0.05–$0.50 per minute of video
Payment processing — $0.30 + % per transaction
At attack scale
10,000 SMS in one hour = $100 in one hour
100,000 AI image requests = $1,000–$4,000
1M AI inference calls = $1,000–$100,000
1M emails in one night = $1,000
1,000 videos transcoded = $50–$500
Even $0.30 calls add up fast at 10k/hr
The bill arrives before the alert does

Cloud billing is usually aggregated — you see it at the end of the month, or only after a cost alert threshold is crossed. An attacker can do enormous financial damage in a few hours before any automated alert fires. Rate limiting is the only real-time defense.

← Back Real incident: Twitter →