CISA issues joint guidance on managing AI token consumption

CISA, the Canadian Centre for Cyber Security and partner agencies published joint guidance on 22 October 2026 called "Managing AI Token Consumption for Operational Resilience", aimed at organisations that depend on third-party AI services billed by the token.

Tokens are the units of text that AI services charge for, both on the way in and on the way out. According to the guidance announcement, as organisations adopt third-party "super intelligence" (SI) services, token-based usage models can affect cost, performance and access to critical services. The agencies say unmanaged token consumption may contribute to rising and unpredictable costs, reduced service availability, degraded performance, token exhaustion, and denial-of-tokens or denial-of-wallet attacks, in which an attacker drives up a victim's metered usage until budgets or quotas run out.

The guidance sets out practical steps rather than rules. CISA says organisations should prioritise token allocation, design efficient workflows, improve user prompting practices, use caching and reusable context, optimise data before it is submitted to a service, and monitor token consumption over time. Caching and reusable context reduce the volume of material resent to a provider on each request; optimising data before submission has the same effect at the input stage.

The agencies direct the advice particularly at critical infrastructure owners and operators. According to the announcement, those organisations can use the guidance to identify mission-critical functions that depend on SI services, to understand their service provider and operational dependencies, and to plan for reduced SI availability during outages, incidents or periods of high demand. That last point frames token budgets as an availability problem as much as a procurement one: if a workflow cannot run without a paid AI service, exhausting the budget has the same effect as an outage.

Cyber defenders are addressed separately. CISA says they can also use the guidance to manage SI-enabled cyber defence workflows while maintaining human oversight, governance and strong cybersecurity fundamentals. Automated defensive pipelines that call AI services on every alert are, by the agencies' own description, consumers of tokens like any other workload.

The publication is guidance, not a binding requirement, and the announcement does not describe any specific incident that prompted it. Nor does it name particular providers or set numerical thresholds for consumption. It is positioned as a resource for organisations to understand and manage token usage in support of operations, with the agencies grouping cost control, resilience planning and abuse resistance into a single document.