🌀 Context Window Tarpit
Recursive MCP tool calls exhausting attacker agent tokens.
This technique acts on infrastructure you do not own. Depending on jurisdiction it may constitute unauthorised access or interference, and it cannot reliably distinguish a hostile actor from a misconfigured legitimate one. Documented for completeness; obtain legal sign-off before any deployment.
What it is
When a malicious AI agent connects to a DOAR Honey-MCP, the server feeds infinitely recursive tool-call responses or massive context payloads. This forces the attacker's agent to exhaust its token budget, incurring massive API costs and halting the attack.
Implementation requirements
- Honey-MCP server with recursive tool-call capability
- Response payloads designed to trigger follow-up tool calls (infinite loop)
- Token budget monitoring to verify exhaustion is occurring
- Graceful termination after sufficient telemetry is captured
- Safety: serve the tarpit only to sessions already flagged as hostile, through a honey tool endpoint that no legitimate internal agent is configured to call
- Safety: hard-cap loop depth, session duration and your own compute or token spend per session, with a kill switch. A runaway tarpit also costs the defender
- Safety: responses must only waste the attacker's context. They must not instruct the attacker's agent to act against third parties or deliver harmful content
- Legal: deliberately consuming an attacker's paid resources is an active measure. Get legal review before deployment
- Rollback: Switch off the tarpit responses with the kill switch, then shut down the endpoint.
- Upkeep: Review the caps on loop depth and spend after each engagement. Renew legal approval at a set interval.
Technologies
Evidence
- Crabs: Consuming Resource via Auto-generation for LLM-DoS Attack under Black-box Settings — Zhang, Y. et al., arXiv:2412.13879 2024 peer-reviewed
- Clawdrain: Exploiting Tool-Calling Chains for Stealthy Token Exhaustion in OpenClaw Agents — Dong, B.; Feng, H.; Wang, Q., arXiv:2603.00902 2026 peer-reviewed
- OWASP Top 10 for LLM Applications 2025 — OWASP 2025 standard
- ATLAS: Adversarial Threat Landscape for AI Systems — MITRE standard
Research basis: - Yuanhe Zhang et al., "Crabs: Consuming Resource via Auto-generation for LLM-DoS Attack" — ACL / arXiv, 2024. > - Ben Dong et al., "Clawdrain: Exploiting Tool-Calling Chains for Stealthy Token Exhaustion in OpenClaw Agents" — arXiv, 2026.