CISA and Canada warn unmanaged AI token use can drain budgets and cut off services

What was published

The US Cybersecurity and Infrastructure Security Agency and the Canadian Centre for Cyber Security have published joint guidance on a problem most security teams have not treated as theirs: how many AI tokens their organization burns. CISA's announcement says the document, Managing AI Token Consumption for Operational Resilience, was released with partners to help organizations understand and manage token usage.

The full text sits on the Cyber Centre site as ITSM.00.125, last modified on 22 October 2026, with a PDF version whose cover carries the flags of Australia, Canada, New Zealand, the United Kingdom and the United States. Its further-reading list points to AI guidance from the Australian Cyber Security Centre, New Zealand's National Cyber Security Centre and the UK National Cyber Security Centre. The text itself refers only to the authoring agencies and does not name every partner.

CISA's summary calls third-party AI services super intelligence, or SI, services, a term US agencies have started using in recent publications. The guidance itself mostly says AI.

Why tokens became a security issue

A token is the small unit of text, image or audio that a model reads and writes, and most commercial AI services bill by it. The guidance explains the basics: input tokens are what you send, cached tokens are inputs the model can reuse from earlier prompts, and output tokens are what it generates.

The agencies note that a simple question may use hundreds of tokens, while analysing large documents or running multi-step automated processes can reach tens of thousands. Agentic workflows compound the cost, because each step reprocesses earlier content and tool outputs.

That billing model is why token use is now an availability and security question rather than just a finance one. If an organization hits its quota, the AI tools it relies on stop answering. And anything that is billed per use can be abused by someone who wants to run up the bill. AI Lookout has covered both sides of this, from where AI gateway token spend actually goes to attacks aimed at agent payments.

The six risks

The document lists six risks. The first is rising and unpredictable costs, since complex workflows, repeated requests and automation make spending hard to forecast. The second is reduced access to critical services, where low-value activity eats capacity needed for important work during busy periods.

The third is limited visibility: without monitoring, organizations cannot see where tokens go, spot inefficiencies or detect unusual activity. The fourth is performance, because larger token counts slow responses, strain memory and can produce inconsistent or duplicated results.

The fifth is token exhaustion, when an organization reaches its allocated limits, quotas, rate limits or budget thresholds. Users then see delays, failed requests or loss of access, which hurts most when AI supports mission-critical work and there is no fallback.

For exhaustion the agencies suggest graduated alerts: an information-only alert at 70% of the token quota, a warning at 80% and a critical alert at 90%. The sixth risk is deliberate abuse, which gets its own section.

Denial of tokens and denial of wallet

The guidance describes two attack types. A denial-of-tokens attack is a resource-consumption attack in which threat actors generate excessive AI usage to exhaust token allocations, drain budgets or trigger rate limits. The methods it lists are automated prompts, abuse of publicly accessible AI interfaces, and manipulating AI-enabled workflows to process unusually large volumes of data.

A denial-of-wallet attack aims to cause financial harm by exploiting pay-per-use pricing. The examples given are prompting AI tools with complex inputs that demand heavy analysis and long outputs, and creating AI loops, where inputs make the tool feed its own output back into itself.

These are not hypothetical patterns. AI Lookout recently reported on a Symantec honeypot that caught an agent hijacking exposed AI models to hack and mine, and on x402 payment flaws that could let a hostile API drain an agent wallet. The new guidance gives security teams official language for treating runaway token spend as an attack surface.

Sort AI work into three tiers

The core recommendation is a tiered governance model that separates token allocations by business impact, so routine use cannot starve important work. Tier 1, mission critical, covers cyber defence, incident response and threat intelligence, and should get the highest priority for token availability.

Tier 2, operational, covers essential processes such as benefits processing, compliance and policy analysis, which should be monitored and managed for reliability and cost. Tier 3, productivity, covers everyday tasks such as drafting emails, summarizing meetings and general research, which may face usage limits or reduced access when demand is high.

The agencies admit dedicated capacity may cost more, but argue it improves resilience. They also warn against going too far the other way, since favouring only critical work can unfairly delay everything else.

Spend fewer tokens on the same job

Much of the document is practical advice that engineering teams will recognize. Design workflows that give enough context without unnecessary prompts, long outputs or repeated processing. Train users to write clear prompts and send relevant excerpts rather than whole files. Use reusable instructions, templates and system settings that encourage concise answers.

Caching gets particular attention. The guidance recommends turning on prompt caching where providers support it and placing static or reusable context at the start of skill definitions and related files to get more cache hits, while noting that each model sets up caching differently. It also suggests preprocessing or filtering data before it reaches a model. For a primer on the underlying arithmetic, see our guide to calculating AI API costs.

Right-sizing is the other big lever. Using the same expensive model for every job is unnecessary, the agencies say, and choosing a smaller model plus a sensible reasoning or effort level limits output tokens, which usually cost more. They also tell organizations to recognize when traditional tools, smaller or locally run models from trusted sources, or manual processes would do the job better.

On resilience, the guidance recommends a multi-provider architecture that avoids dependence on a single vendor, routing workloads to other providers during outages, and deferring lower-priority productivity uses until mission-critical workloads have been tested at expected demand. Staff training should cover capping output length and bounding agentic loops.

It also calls for what it terms AI harnessing: engineering the software around an agent so it runs tasks reliably, and running risk assessments before any agent operates autonomously. Consequential AI-driven actions should still need human authorization.

Watch the meter like a network

The monitoring section is where the security angle is clearest. The agencies recommend token usage baselines and forecasting, alerts for unusual consumption or approaching limits, and treating sudden jumps in token use as a possible sign of data exfiltration, in the same way abnormal bandwidth spikes can signal unauthorized transfers.

They also advise feeding AI token telemetry into a security information and event management platform and correlating it with identity, cloud, API and system logs. AI gateways and proxies are named as an increasingly practical way to measure consumption, enforce quotas, apply guardrails and support internal chargeback.

Governance should sit with a working group spanning IT security, finance, legal and operations, and third-party AI providers should be assessed for reliability, quota limits and token availability risks before contracts are signed.

What it asks of cyber defenders and critical infrastructure

For cyber defenders, the message is that AI can find vulnerabilities faster and speed response, but every task has a token cost. Teams should use smaller models for simpler security work and save larger models and agents for complex tasks, while remembering that AI does not replace strong fundamentals, human oversight or Secure by Design practices.

Critical infrastructure operators get a separate checklist. They should map which services depend on AI and on which providers, plan for reduced AI availability during outages or high demand, consider how emergencies could raise AI usage, fold AI into continuity planning, and keep non-AI capabilities, including manual operations training, in case AI becomes unavailable or untrustworthy.

What is missing

The guidance is high level. It names no vendors, gives no cost figures and offers no reference thresholds beyond the illustrative 70, 80 and 90 percent alerts. It does not say how common denial-of-wallet attacks are or cite specific incidents, so organizations will have to judge their own exposure.

It is also voluntary. Like most joint cyber guidance from these agencies, it sets out recommended practices rather than requirements, and it is written for organizations of any size and sector, which means teams will need to translate it into their own quotas and policies.

Why it matters

Token budgets have quietly become an operational dependency as organizations wire chatbots and agents into everyday work. This guidance is one of the first times national cyber agencies have said plainly that running out of tokens is a resilience failure and that someone running up your AI bill is a security incident.

For teams already using AI gateways, rate limits and spend alerts, much of this will read as confirmation. For those that bought AI seats and API keys without a usage plan, the three-tier model, the alert thresholds and the advice to watch token spikes alongside other security logs are a reasonable place to start.