The Cybersecurity and Infrastructure Security Agency (CISA) and the Canadian Centre for Cyber Security released guidance Thursday warning that unmanaged use of paid AI services can drive up costs, slow performance and cut off access to critical functions. The document treats AI usage limits as an operational resilience problem, not just a line in the IT budget, and asks critical infrastructure operators to plan for periods when AI is unavailable.
What Happened
The guidance, "Managing AI Token Consumption for Operational Resilience," was published by CISA and the Cyber Centre with unnamed partners. The full text, posted by the Cyber Centre, refers only to "the authoring agencies."
Tokens are the small units of text that AI models read and write, and providers bill by them. A simple question may use hundreds of tokens; analyzing large documents or running multi-step automated tasks can use tens of thousands. Use climbs with long inputs and outputs, repeated requests, long conversation histories and AI agents, programs that work through tasks step by step and reprocess earlier content at each step.
The guidance warns of token exhaustion, when an organization hits a quota, rate limit or budget cap and requests slow down or fail. It also names two attacks. In denial-of-wallet, attackers exploit usage-based pricing to inflate an organization's bill. In denial-of-tokens, they generate excess usage to burn through allocations or trigger limits so legitimate users are shut out.
What It Asks Organizations to Do
The agencies recommend splitting AI capacity into three tiers. Mission-critical work such as cyber defense, incident response and threat intelligence comes first. Operational work such as compliance and policy analysis is monitored. Productivity uses such as email drafting and meeting summaries may face limits when demand is high.
Other steps include reusing previously processed content through caching, matching smaller and cheaper models to simpler tasks, using more than one provider so work can shift during an outage, and routing traffic through AI gateways that enforce quotas. Consequential AI-driven actions should require human authorization.
On security, organizations should set a baseline for normal token use, feed usage data into their security monitoring systems and treat unusual consumption as a possible sign of data theft. One example sets alerts at 70%, 80% and 90% of a quota. The guidance also advises understanding token pricing before signing contracts with AI vendors.
Critical infrastructure owners are told to identify which functions depend on AI, map their provider dependencies, build AI into continuity plans and keep non-AI fallbacks, including manual procedures.
Why It Matters
As AI agents move into security operations and business processes, a provider's rate limit becomes a potential single point of failure. Boards should ask whether essential functions could stall if a provider throttles access or an attacker drains the budget, and who decides which uses get cut first.
What to Watch
The guidance is voluntary. Watch whether the agencies name the other co-authors, whether regulators fold its advice into sector requirements, and whether AI vendors offer reserved capacity or contract terms that address exhaustion risk.
