CISA and Five Eyes partners publish guidance on managing AI token consumption
CISA, the Canadian Centre for Cyber Security, Australia's ASD ACSC, New Zealand's NCSC and the UK NCSC published joint guidance on October 22, 2026, titled Managing AI Token Consumption for Operational Resilience, for organisations using third party super intelligence LLM services. The guidance says unmanaged token consumption can drive rising and unpredictable costs, reduced service availability, degraded performance, token exhaustion, and denial of tokens or denial of wallet attacks.
The agencies advise organisations to prioritise token allocation for mission critical uses, monitor consumption with alerts for unusual activity or approaching limits, and reduce waste through efficient workflows, caching, reusable templates and better prompting. Critical infrastructure owners and operators are told to identify which mission functions depend on these services, understand provider dependencies, and plan for reduced availability during outages, incidents or periods of high demand.