# Aatmf T05 API Exploitation

AATMF T5, Model & API Exploitation.

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill aatmf-t05-api-exploitation -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill aatmf-t05-api-exploitation -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill aatmf-t05-api-exploitation -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill aatmf-t05-api-exploitation -g -a gemini-cli -y`

## Description

AATMF T5, Model & API Exploitation. Rate-limit abuse, token-cost amplification, schema bypass, model-version manipulation.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# T5, Model & API Exploitation

Attack the LLM as an *API service*, its rate limits, billing, schema
expectations, version routing. Adjacent to classical API security but
LLM-specific.

## Techniques

### T5.001, Rate-limit / quota abuse
Standard distributed-request patterns: multiple accounts, IP rotation,
free-tier exploitation. Specifically interesting for LLM APIs:
- Free-tier exhaustion via automation (DDoS of competitor's free tier)
- Per-user rate limit on multi-user platforms, single attacker
  exhausts shared quota
- Burst pattern matching specifically targeting the upstream provider's
  rate limits (Anthropic, OpenAI) to cause downstream service degradation

### T5.002, Token-cost amplification
Make the model produce *expensive* outputs to bleed the operator's budget:
- "Repeat the word 'token' 500 times then continue..."
- Generate maximum-token responses every time via prompt engineering
- Exploit streaming endpoints to keep response generation going past
  cost reasonability
- Quadratic prompts: "Each turn double the length of the last response"

Variant: **prompt-amplification attack**, small attacker request
triggers massive computation (T5.002 ↔ T14 economic warfare overlap).

### T5.003, Schema bypass via raw text
APIs that wrap LLMs often enforce JSON schemas on outputs (structured
output mode). Bypass via:
- Prompt the model to return raw text where JSON is expected
- Embed structured markers that the schema validator strips
- Function-calling endpoints: induce model to NOT call the function
- Request format that confuses parsing (extra commas, unicode whitespace)

### T5.004, Model-version manipulation
APIs that expose `model_id` parameter sometimes accept unintended
values (cheaper / older / less-aligned models). Probe:
- `model_id=base` (pre-RLHF base model)
- `model_id=test`, `model_id=staging`
- `model_id=<provider>/<wrong-prefix>/<actual-model>`
- Wildcard matches: `model_id=*`

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/plugins/llm-redteam/t05-api-exploitation/SKILL.md