New Joint Guidance Warns Unmanaged AI Token Use Can Drive Up Costs and Disrupt Services

CISA, the Canadian Centre for Cyber Security and partners have released joint guidance called Managing AI Token Consumption for Operational Resilience. It helps organisations understand how token-based pricing and usage limits for third-party AI services can affect cost, performance and access to critical services.

The guidance warns that unmanaged token consumption can lead to rising and unpredictable costs, reduced service availability, degraded performance and token exhaustion. It also flags denial-of-tokens and denial-of-wallet attacks. Practical steps include prioritising token allocation, designing efficient workflows, improving how users write prompts, using caching and reusable context, optimising data before it is submitted, and monitoring consumption over time.

The advice is aimed at critical infrastructure owners and operators, who can use it to identify mission-critical functions that depend on AI, understand provider dependencies, and plan for reduced AI availability during outages, incidents or periods of high demand. Cyber defenders can also use it to manage AI-enabled defence workflows while keeping human oversight, governance and strong cybersecurity fundamentals in place.