diff --git a/src/main/java/org/eu/autogex/core/AbstractAutomatonBuilder.java b/src/main/java/org/eu/autogex/core/AbstractAutomatonBuilder.java
index baa8c4d6..3fdc49e9 100644
--- a/src/main/java/org/eu/autogex/core/AbstractAutomatonBuilder.java
+++ b/src/main/java/org/eu/autogex/core/AbstractAutomatonBuilder.java
@@ -13,6 +13,11 @@
 public abstract class AbstractAutomatonBuilder<
         B extends AbstractAutomatonBuilder<B, A>, A extends Automaton> {
 
+    /**
+     * Maximum allowed states in a manually constructed automaton to prevent state explosion (DoS).
+     */
+    protected static final int MAX_STATES = 10000;
+
     protected final Map<String, State> states = new HashMap<>();
     protected final Set<State> finalStates = new HashSet<>();
     protected State initialState;
@@ -39,6 +44,10 @@ protected AbstractAutomatonBuilder() {
      * @return The current builder instance.
      */
     public B addState(String name, boolean isFinal) {
+        if (states.size() >= MAX_STATES) {
+            throw new IllegalStateException(
+                    "Automaton state limit exceeded (Security: DoS prevention).");
+        }
         State state = new State(name, isFinal);
         states.put(name, state);
         if (isFinal) {