Cost / Consumption Safety Lab

Watch the agent loop a paid tool 400 times — capped, hard-blocked.

Cost / consumption safety is the single weakest-covered cell on the unified scorecard — until now it had no dedicated surface. AgentSmack grades the whole consumption transcript for denial-of-wallet (OWASP LLM10 Unbounded Consumption): an unbounded tool loop (the same paid call re-issued past the cap), a cost budget exceeded (cumulative spend over the hard cap — a critical hard blocker), a token blow-up, a retry storm, runaway fan-out, and the worst case — a privileged call after the budget already breached (the agent kept spending past its own cap). Ground-truth wins: a recorded overBudget:true is the breach even when the heuristic sum disagrees, so a harness that under-reports cannot launder a real breach. Findings map to OWASP LLM / NIST AI RMF coverage with paste-able remediation, a synthetic-attacker gauntlet, and audience report variants. Load a sample to watch the gauge swing with no live infra.