An AI-backed endpoint passes requests to a language model, and every request that reaches the model is a paid call. A DAST scan sends thousands of requests, so a scanner that cannot tell which routes call a model spends the app owner's model budget on its attack payloads. In measured scans of open-source apps, one full scan used up to 3.5 million tokens.
Key takeaways
- A DAST scan that cannot tell which routes call a model can turn its attack payloads into model calls, and the app owner pays for every token.
- OWASP calls the attacker's version of this traffic Denial of Wallet. A security scanner produces the same traffic without meaning to.
- In NightVision's measured scans, one full scan used 335,674 tokens on a small shop API, 907,272 on the note app SiYuan and about 3.5 million on the resume builder Reactive Resume.
- At Claude Sonnet 4.6 list prices, those three scans would cost about $1.71, $5.88 and $13.93 per run.
- Three things decide the bill: whether the scan reaches the model, how many tokens each call carries, and how many model calls one request starts.
- The scan report does not show the bill. The model provider's usage metrics do.
- Wallet-aware DAST scanning keeps ordinary payloads away from routes that call a model, and tests those routes with checks built for AI risks.
Why a scan request to an AI endpoint costs money
An AI-backed endpoint passes its input to a language model and returns the answer. The model provider charges for every token the model reads and every token it writes, so each request that reaches the model has a price.
A dynamic application security test sends crafted input to every parameter of every route it finds. A full scan of a small API sends thousands of requests. Each payload that gets through to the model becomes a paid call: the model reads the payload and the app's own prompt around it, then writes a reply.
Output tokens usually cost more than input tokens. PostHog, an open-source product analytics platform, names Claude Sonnet 4.6 in the code of its AI assistant.[1] That model lists $3 per million input tokens and $15 per million output tokens.[2] A model that answers a strange payload with a long, polite explanation turns each attack into the expensive kind of token.
Denial of Wallet, without an attacker
OWASP names this pattern in its Top 10 for LLM applications. Its entry on unbounded consumption reads: "Unbounded Consumption occurs when a Large Language Model (LLM) application allows users to conduct excessive and uncontrolled inferences, leading to risks such as denial of service (DoS), economic losses, model theft, and service degradation."[3]
One of its examples is Denial of Wallet: "By initiating a high volume of operations, attackers exploit the cost-per-use model of cloud-based AI services, leading to unsustainable financial burdens on the provider and risking financial ruin."[3]
A security scanner is not an attacker. To the model provider, though, a scan looks the same: a high volume of requests from one client, each one billed. The difference is intent, and intent does not change the invoice.
Worked example: one scan of a shop API, counted twice
A small shop API makes a clean test case. It has five ordinary routes and three AI routes, a chat, a conversation and a summary, each calling an open model hosted by a cloud provider. A full NightVision scan of it ran for 14.5 minutes.
During that scan, the app made 1,376 model calls. They used 277,028 input tokens and 58,646 output tokens, 335,674 in total. The cloud provider's usage metrics for the same minutes showed the same totals as the app's log. Every logged call came from the scan, because only the scanner held the app's key.
That is about 95 model calls a minute over the whole scan. The open test model costs $0.15 per million input tokens and $0.60 per million output tokens,[4] so the scan cost about 8 cents. At Claude Sonnet 4.6 list prices, the same tokens would cost about $1.71.
A second full scan of the same app, about an hour later in a pre-release environment, made 1,378 model calls and used 366,541 tokens. The bill is not a one-off. It comes back with every scan.
Six open-source apps, six different bills
The shop API was built for testing. To see what happens on real software, the same kind of full scan ran against six open-source apps with their AI features switched on. Each app's AI called an open model through a proxy that logged every call and its tokens.
The two biggest bills came from apps whose AI routes accepted the scanner's ordinary requests. SiYuan, a note app with an AI chat, made 604 model calls and used 907,272 tokens in one full scan. Reactive Resume, a resume builder, made 5,470 model calls and used about 3.5 million tokens, even though 920 of those calls failed at the provider and used none.
At Claude Sonnet 4.6 list prices, the SiYuan scan would cost about $5.88 and the Reactive Resume scan about $13.93. Run nightly, the Reactive Resume scan alone would come to about $420 a month.
Metabase, a business intelligence tool, shows a different pattern. A full scan made only 15 model calls, but they used 106,137 tokens. One scan request reached its assistant, which ran an agent loop of 15 model calls to answer it.
The other three apps cost little or nothing, for reasons the next section explains. PostHog's AI features rejected most scan requests before any model ran, so a full scan made 31 calls and used 624 tokens. Full scans of the recipe manager Mealie and the Kubernetes dashboard Kite reached no model at all.
Three things that decide the bill
The six apps ranged from no tokens to about 3.5 million per scan. Three properties of an app explain that range, and a scan report shows none of them.
1. Whether the scan reaches the model. PostHog checks its AI input, needs a session or extra rights for some AI routes, and limits AI use per user. Most scan requests to its AI routes stopped at one of those checks, before any model ran. Mealie's AI routes need a field that selects the AI parser, or a file upload, and the scan sent the default, non-AI parser instead. Kite's AI routes rejected every scan request with an error before any model ran.
2. How many tokens each call carries. A call to the shop API used about 244 tokens on average, and a call to SiYuan about 1,500. On SiYuan, the same model also wrote about ten times more per answer: 435 output tokens on average, against 43 on the shop API. At Sonnet 4.6 prices, those output tokens would be two thirds of the SiYuan bill.
3. How many model calls one request starts. An assistant that plans and calls tools can run several model calls for one question. On Metabase, one scan request started a loop of 15 calls, and each call averaged about 7,000 tokens.
Who sees the bill
A scan report lists findings, not the model calls the scan caused. The cost lands on the model provider's invoice instead, so the team that reads the report does not see it there.
The cost can be found, though. On the shop API, the provider's usage metrics matched the app's own log in total, and the app's key showed that every call came from the scan. Comparing the scan window with a normal window shows what the scan spent.
Two ways a scanner can treat an AI endpoint
The difference between a costly scan and a cheap one is what the scanner knows before it starts. A scanner that knows which routes call a model can choose what to send there, while one that treats every route alike sends every payload everywhere.
| Treats every route alike | Knows which routes call a model | |
|---|---|---|
| Ordinary attack payloads on an AI route | Each one that reaches the model is a paid call | Not sent there |
| The model's replies | Read as evidence by ordinary checks | Judged only by checks built for AI risks |
| AI-specific risks | Tested among thousands of unrelated payloads | Tested by checks built for them |
| Who pays, and for what | The app owner, for every payload that reaches the model | The app owner, only for the AI checks' calls |
| What the scan report shows | Findings, with no sign of the bill | Findings, and which routes call a model |
NightVision calls the second way wallet-aware DAST scanning: the scanner finds the AI endpoints first, then runs its ordinary checks everywhere else and its AI checks on the AI routes.
What a scanner needs to know first
The fix starts with one fact: which routes call a model. With it, ordinary checks can leave those routes alone, and checks built for AI risks can test them on purpose.
Leaving AI routes out of the scan is not the answer. A model that can fetch a URL or call a tool can be steered into requests the app never meant to make, such as a read of the cloud metadata service. A scan finds that only by testing the AI route. NightVision's LLM cloud metadata check does exactly that, and confirms the read by the cloud provider's own signature.
Finding the routes is the hard part. An API description has no standard way to say that a route calls a model, and some apps wrap every input in a fixed task, so the route does not look like a chat. Scanning AI routes blindly also has a second cost: false positives from model replies. Other posts in this series cover those false positives and how a scanner can build that list: from the code, from signals in the crawl's traffic, and with an active check that asks the model two questions.
Honest limits
The numbers come from test setups. Each app's AI used an open model, every call was logged with its tokens, and every scan ran the default checks and time limit with an API credential. A different model writes replies of a different length, so the same scan on another model would use a different number of tokens.
The price example applies Claude Sonnet 4.6 list prices to tokens counted on another model. It shows the scale of the bill, not an exact invoice, because each model family also splits text into tokens in its own way. Some newer models list lower prices, which shrinks the bill but not the number of calls.
A scan reaches only what it can reach. In these tests, input checks, sessions, rights and required fields kept the scanner away from several models. The same apps with other settings, or scanned with a browser session or more rights, could cost more.
Frequently asked questions
Does a DAST scan really call my language model?
Yes, whenever a scan request reaches a route that passes its input to a model. In the shop API test, the model provider's own metrics counted 1,376 calls during one scan, the same number as the app's log.
Who pays for the tokens a scan uses?
The owner of the app's model provider account. Every model call is billed to that account at its price per token, no matter who sent the request.
Why did some apps cost almost nothing?
Their AI routes rejected or bypassed the scan's requests before a model ran. PostHog checks input, sessions, rights and a per-user AI limit, and Mealie runs its AI parser only when a request asks for it. An app built that way keeps most scan traffic away from its model.
Should I exclude AI endpoints from scans?
No. AI routes carry risks of their own, such as a model steered into fetching an internal address. Excluding them removes the cost and the test together. The better design keeps ordinary payloads away from them and tests them with checks built for AI risks.
What is wallet-aware DAST scanning?
Wallet-aware DAST scanning means a scanner knows which routes call a paid model before it attacks them. It keeps ordinary payloads away from those routes and tests them only with checks built for AI risks, so the scan itself does not become Denial of Wallet.
How can I see what a scan costs on my app?
Compare your model provider's usage metrics for the scan window with a normal window. Your app's logs show which calls came from the scanner's credential or address.
Does a cheaper model fix the problem?
It lowers the price, not the traffic. On the open test model, the shop API scan cost about 8 cents, but it still made 1,376 model calls, and ordinary checks still read every reply as evidence.
References
- PostHog source code, ee/hogai/core/agent_modes/executables.py, line 278, at commit 8045da0.
- Anthropic, Claude pricing, list prices for Claude Sonnet 4.6, accessed October 2026.
- OWASP Top 10 for LLM Applications 2025, LLM10:2025 Unbounded Consumption.
- Amazon Web Services, Amazon Bedrock pricing, Qwen3 32B, accessed October 2026.