The enhanced capabilities of LLM-based agents bring an urgent need to address safety risks in planning and tool use. Due to the helpfulness–harmlessness trade-off in LLM alignment, agents typically also inherit the flaw of Over-Refusal, which is a passive failure mode. However, the proactive planning and action capabilities of agents introduce another emerging danger on the opposite side of this trade-off. We term this phenomenon **Toxic Proactivity**: an active failure mode in which an agent, driven by the optimization for Machiavellian helpfulness, prioritizes utility over ethics. Toxic Proactivity manifests as the agent taking excessive or manipulative measures to ensure its usefulness is maintained. Existing research pays little attention to identifying this behavior, as it often lacks the subtle context required for such strategies to unfold. To reveal this risk, we introduce a novel evaluation framework based on dilemma-driven interactions between dual models, enabling the simulation and analysis of agent behavior over multi-step behavioral trajectories. Through extensive experiments with multiple mainstream LLMs, we demonstrate that Toxic Proactivity is a widespread behavioral phenomenon and reveal two major tendencies: direct violation and strategic misalignment. We further present a systematic benchmark for evaluating Toxic Proactive behavior across contextual settings.

Resource utilization has been studied as an optimization objective for generative large language models (LLMs). Recent studies show that this resource dependence can also be weaponized, as excessive generation, when scaled through high-volume requests, increases inference latency, undermines service availability, and threatens economic sustainability. However, these risks remain underexamined because existing studies are fragmented and their boundaries with legitimate, resource-intensive uses of LLMs are unclear. To address this gap, we provide a systematic review of threats to resource consumption in LLMs. Unlike surveys on inference acceleration, we focus on how resource consumption threats induce disruptive behaviors and synthesize existing studies into research strands that connect attack objectives, triggering mechanisms, and defenses. We further introduce an outcome-based severity taxonomy that distinguishes bounded, non-degenerate Overthinking from self-sustaining Unbounded Drift, providing operational criteria for characterizing adversarial resource consumption. Our goal is to clarify this emerging threat landscape and support future characterization, evaluation, and mitigation. The project repository is publicly available at https://anonymous.4open.science/r/RCT-LLM/.

Large Language Models (LLMs), due to substantial computational requirements, are vulnerable to resource consumption attacks, which can severely degrade server performance or even cause crashes, as demonstrated by denial-of-service (DoS) attacks designed for LLMs. However, existing works lack mitigation strategies against such threats, resulting in unresolved security risks for real-world LLM deployments. To this end, we propose the Pluggable and Dynamic DoS-Defense Framework (PD³F), which employs a two-stage approach to defend against resource consumption attacks from both the input and output sides. On the input side, we propose the Resource Index to guide Dynamic Request Polling Scheduling, thereby reducing computing resource usage induced by malicious prompts under high-concurrency scenarios. On the output side, we introduce the Adaptive End-Based Suppression mechanism, which reduces excessive malicious generation. Experiments across six models demonstrate that PD³F significantly mitigates resource consumption attacks, improving users’ access capacity by up to 500% during adversarial load. PD³F represents a step toward the resilient and resource-aware deployment of LLMs against resource consumption attacks.

Large Language Models (LLMs) have demonstrated remarkable performance across diverse tasks yet still are vulnerable to external threats, particularly LLM Denial-of-Service (LLM-DoS) attacks. Specifically, LLM-DoS attacks aim to exhaust computational resources and block services. However, existing studies predominantly focus on white-box attacks, leaving black-box scenarios underexplored. In this paper, we introduce Auto-Generation for LLM-DoS (AutoDoS) attack, an automated algorithm designed for black-box LLMs. AutoDoS constructs the DoS Attack Tree and expands the node coverage to achieve effectiveness under black-box conditions. By transferability-driven iterative optimization, AutoDoS could work across different models in one prompt.Furthermore, we reveal that embedding the Length Trojan allows AutoDoS to bypass existing defenses more effectively.Experimental results show that AutoDoS significantly amplifies service response latency by over 250×↑, leading to severe resource consumption in terms of GPU utilization and memory usage. Our work provides a new perspective on LLM-DoS attacks and security defenses.