Companies including Microsoft, Meta, and Accenture are cutting down on ‘tokenmaxxing’ in a bid to slash costs. The tech giants aren’t the only ones cracking down on the practice. Many firms are realising the issues caused by tokenmaxxing as AI prices rise and governance becomes a growing problem.

The trend is in stark contrast to last year, when employees were given access to a wide range of AI tools, with businesses encouraging staff to explore different use cases to boost efficiency. As adoption grew and frontier providers increasingly moved towards consumption-based pricing, spending rose with it.

With companies such as Microsoft still saying they are AI-first, what are the security risks of tokenmaxxing and how might this change as firms try to crack down on it?

Tokenmaxxing problems

Tokenmaxxing has happened because organizations began measuring AI adoption success via metrics such as token consumption and prompt volume.

As costs began to surge, the recent crackdowns are driven by economics. “Organizations realized that token consumption is not the same as business value,” explains Daniel dos Santos, VP of research at Forescout. He points out that token spend can become “unpredictable”, especially because agentic AI consumes significantly more tokens than traditional chatbots.

Agentic AI sees employees building small agents using more powerful and expensive models than the task requires. Some of those agents may then be forgotten but continue operating in the background, consuming tokens and “quietly accumulating costs”, says Conal Gallagher, CISO and CIO at Flexera.

But the issues go beyond the rising costs. Putting vast amounts of company data into large language models (LLMs) to improve results creates governance problems, leaving many firms introducing controls too late in the process.

Oversharing is a significant risk, according to Tracey Hannan-Jones, consulting director, Information Security, UBDS Digital. “Employees seeking better AI outputs can inadvertently feed customer information, financial records, board papers, proprietary code, and other sensitive material into cloud-hosted AI systems.”

In some cases, business policies are making the problem worse. The more employees are encouraged to maximize usage, the greater the temptation to feed large amounts of internal data into AI systems to generate richer responses, says Geert Busse, solutions architect director EMEA, go-to-market at Westcon-Comstor. “That creates obvious concerns around data exposure, particularly if organizations have not implemented clear guardrails around what information can be shared with models and where the data is processed.”

Garth Fort, CPO at LogicMonitor, has experienced the issues with tokenmaxxing firsthand. He says his firm is “actively encouraging the adoption of AI into workflows”.

For Fort, one of the biggest lessons has been around cost, but he acknowledges that rapid adoption can create cybersecurity and governance blind spots, “especially when employees use AI tools without much oversight”.

Unintended consequences

Tokenmaxxing crackdowns can in some ways be beneficial for security, but firms should be careful of unintended consequences.

As experts point out, aggressively restricting token usage brings risks of its own. Reducing prompt sizes can strip away important context, including security instructions and data-handling rules, according to Hannan-Jones.

It could also encourage an increase in so-called shadow AI, with employees using unsanctioned services to get the job done. Hannan-Jones describes how cost controls can encourage employees to move towards cheaper, unofficial AI services that lack enterprise agreements, residency controls, and appropriate data protections. “In other words, organizations can reduce their visible AI bill while increasing their invisible security liability,” she explains.

At the same time, reducing token usage might delay security initiatives. Security teams increasingly rely on AI for threat detection, security operations center automation, code review, vulnerability management, and other use cases, points out dos Santos. “Cost-cutting measures that treat all AI usage equally may inadvertently reduce investments that actually improve cyber resilience.”

Meanwhile, as organizations look for ways to reduce AI costs, some will explore moving workloads away from commercial models and towards open source models running on their own infrastructure. That may lower inference costs, but “it also shifts a much larger share of the security responsibility onto the organization itself”, according to Busse.

“When businesses operate their own AI stack, they need to think about additional controls such as AI gateways, observability tools, model guardrails and protection against threats including prompt injection,” explains Busse.

“They also inherit many of the traditional security challenges associated with any critical infrastructure, from identity compromise to software vulnerabilities and denial-of-service attacks.”

Cost optimization can also introduce architectural complexity. Techniques such as model routing, where different requests are sent to varying models, or the use of caching to reduce computation costs, can deliver meaningful savings. However, every additional layer “increases operational complexity”, warns Busse.

“As we know, complexity is often the enemy of security if it is not designed and governed properly.”

Managing tokenmaxxing security risks

Businesses need to govern both tokenmaxxing and the crackdown on it, according to Hannan-Jones. That means “establishing clear AI data-classification policies” defining “what information can be submitted to which systems”.

She advocates improving logging and observability; bringing AI procurement within third-party risk management; and training employees in effective “prompt hygiene”.

Right now, organizations should not optimize for token consumption or reduction, says dos Santos. He recommends measuring outcomes instead of usage. “Aim for risk-adjusted business value by first establishing AI governance policies that clearly define approved AI services and what types of data can be provided to them,” he advises.

Firms should look at enabling technical controls provided by AI services such as logging, access controls, and data protection capabilities – as well as external controls such as data loss prevention and AI-specific monitoring, he says.

At the same time, he recommends “continuously monitoring for shadow AI and unauthorized AI services being accessed across the network”.

Gallagher believes firms need to know what is in their environments and ensure they can respond “quickly” when things change. “Companies also need to give people approved tools that they can actually use. Otherwise, they may have a policy on paper without knowing where the work is really happening.”