The US Cybersecurity and Infrastructure Security Agency (CISA), the Canadian Centre for Cyber Security and partner agencies have published joint guidance warning that organizations leaning on third-party AI services can lose access to them simply by running out of tokens, the metered units those services bill and ration by.
The document, titled Managing AI Token Consumption for Operational Resilience, treats a token budget as an availability problem, not just a finance line. As organizations adopt what the agencies call third-party super intelligence (SI) services, CISA says, token-based usage models can affect cost, performance and access to critical services.
When the meter runs out, the service stops
CISA lists the risks of unmanaged consumption plainly: rising and unpredictable costs, reduced service availability, degraded performance, token exhaustion, and denial-of-tokens or denial-of-wallet attacks. Those last two describe abuse rather than accident, broadly an adversary driving up a victim's usage until the quota or the budget is gone. It is not hypothetical. Earlier this week Wiz described attackers who phished Google Cloud administrators and charged mass Gemini usage to the victims' billing accounts.
Critical infrastructure owners and operators are asked to identify which mission-critical functions depend on SI, understand their service provider and operational dependencies, and plan for reduced SI availability during outages, incidents or periods of high demand.
Ration tokens like any scarce resource
The practical steps the agencies outline are to:
- prioritize token allocation
- design efficient workflows
- improve user prompting practices
- use caching and reusable context
- optimize data before it is submitted
- monitor token consumption over time
The guidance also speaks to security teams that now run SI-enabled cyber defense workflows, telling them to manage those workflows while maintaining human oversight, governance and strong cybersecurity fundamentals. That point deserves weight. A defensive pipeline that quietly depends on an AI service shares that service's quota, so a spike elsewhere in the organization, or an attacker burning tokens on purpose, could leave defenders without a tool they have come to rely on.
The audience is wide: executives, federal agencies, industry, small and medium businesses, and state, local, tribal and territorial governments. It follows an October 16 publication from CISA, NIST and the NSA on responding when advanced AI agents take actions nobody told them to take, and together the two documents show the agencies moving from what AI can do toward what happens when it stops doing what an organization expects.
The message for anyone who has wired an AI service into daily operations is that a quota is a dependency, and dependencies fail. Planning for the day the tokens run out belongs in the same continuity plan as planning for the day the network goes down.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.