Token bleed

For the past few years, C-suite conversations around generative AI have been dominated by two themes: productivity gains and data privacy. Executive committees have spent countless hours worrying about proprietary data leaking into public models. To make the problem worse, we're on the verge of seeing foolish organizations attempt to measure employee performance or AI adoption by token volume. 

But while we have been building fences around our data, we have left the corporate vault wide open to a new, highly volatile financial exposure: token burn.

In an era where AI agents and LLMs are deeply integrated into enterprise architecture, an API key is no longer just a standard technical credential . It is an unthrottled corporate credit card. And, right now, companies are realizing they have no idea who is swiping it or how fast. 

Tokens do for money what casino chips do for cash. The chip is engineered to make you forget you’e spending real dollars, and an API key works the same way. Spending is abstracted into units that don’t feel like money, so the friction that makes a person think twice before a large purchase is simply gone. No repercussions at the moment, and in most organizations, nobody is watching.

The token strike and the new shadow sabotage

In industrial history, there is a legendary concept known as the Japanese-style Strike. Instead of walking off the job, employees work harder, faster and longer, strictly adhering to every minute rule to disrupt the system through overproduction and malicious compliance.

What does a Japanese Strike look like today? Massive, intentional token exhaustion.

While a coordinated worker strike targeting tokens remains a boardroom nightmare, the cultural precursor is already here. Silicon Valley has seen the rise of a reckless developer trend known as tokenmaxxing, a practice documented by The Pragmatic Engineer and Forbes in early 2026, when engineers at Meta, Microsoft and Salesforce competed on internal leaderboards to burn the most tokens. Meta alone logged 60.2 trillion tokens in a single month before scrapping its leaderboard. Tokenmaxxing is the habit of intentionally burning as much compute and token volume as possible under the flawed assumption that raw compute always equals faster innovation.

If you're in the C-suite (or, indeed, any layer of management) it's worth considering whether your current financial controls would catch a sudden surge in token consumption. In most organizations, financial auditing is retrospective, which means we look at invoices at the end of the month. If a rogue team or an overenthusiastic department decides to max out tokens, a company could quickly rack up a catastrophic bill well before traditional IT monitoring tools trigger an alert.

Denial of wallet attacks: Malware’s new profit center

This vulnerability isn’t just an internal governance issue, it’s now a primary target for cybercriminals. This threat vector has a name: LLMjacking, a term coined by the threat research team at Sysdig.

Historically, when malware infected a corporate network, the goal was ransomware or data theft. Today, threat actors are aggressively targeting the AI development pipeline. Cybersecurity researchers at Aikido Security recently uncovered a coordinated campaign involving malicious JetBrains IDE plugins stealing AI API keys directly from developer environments.

These stolen keys, spanning OpenAI, DeepSeek and SiliconFlow, are funneled into a growing black market where attackers resell your paid API access to third parties. The result is a devastating denial-of-wallet attack. Because AI providers charge based on real-time consumption, the financial damage hits at machine speed, racking up massive corporate liabilities while the attackers profit. Researchers now estimate that a single active LLMjacking campaign can drain roughly one hundred thousand dollars per day from a compromised account.

The unintended loops of operational AI risk

We’ve seen this before. When cloud computing arrived, the pitch was all about saving money. Then developers started spinning up a workload to test something, left it running and forgot about it and companies woke up to surprise bills from idle infrastructure in their lower environments. Token spend follows the same pattern at higher velocity. An idle cloud instance burns a slow, predictable trickle. A runaway agent loop burns at machine speed.

Even without malicious intent, token spending is a ticking operational risk due to poor software architecture. As the enterprise moves toward Agentic AI, meaning systems where autonomous AI models interact with other models to accomplish multiple step tasks, the risk of automated financial runaway skyrockets. Gartner estimates that agentic tasks consume five to thirty times the tokens of an equivalent chatbot interaction, and most enterprise agent rollouts exceed their pilot budget by four to eleven times within the first ninety days.

This isn’t theoretical. In a widely reported 2025 incident, a four-agent pipeline ran blindly for eleven days and burned roughly forty-seven thousand dollars before anyone realized two of the agents were trapped in an endless cycle of reverifying the same data. The figure has been repeated across the industry and debated, but the failure mode is real and well documented. 

When agents get stuck, they don’t just crash a server; they actively drain corporate liquidity in real time. The damage isn’t always a dramatic loop. In one widely reported case, a healthcare organization absorbed roughly six million dollars in unplanned costs after its systems consumed close to a trillion tokens over six months, most of it ordinary usage that no one was watching.

The AI maturity curve: From wild west to metric mania

Most enterprises are moving through a highly predictable, yet deeply flawed, AI adoption lifecycle.

• Phase 1: Radical experimentation. Management shouts to just innovate. Employees are encouraged to use AI with zero tracking or central oversight. In reality, there’s a lack of financial visibility. Token spend is buried in disparate departmental credit cards.
• Phase 2: Panic governance. The first aggregated bills arrive. Executive leadership panics and slaps rigid, arbitrary limits on API usage. In turn, innovation stalls. Uber burned through its entire 2026 AI budget in just four months on tools like Claude Code and Cursor, then capped employees at fifteen hundred dollars per tool per month.
• Phase 3: Tactical FinOps. The organization realizes they must train employees. However, they train them how to use AI, not how to optimize it. This leads to the unfortunate situation where high costs persist because no one understands prompt efficiency, caching or model routing.

The ultimate pitfall: Measuring performance by the token

As companies struggle to quantify AI ROI, some management teams will inevitably fall into a historical trap. Decades ago, misguided IT managers measured programmer productivity by lines of code, a metric that famously rewarded bloated, inefficient and buggy software.

Measuring token consumption as a proxy for productivity is an express lane to bankruptcy. It directly incentivizes bloated prompts, lazy inputs and massive financial waste, completely decoupling corporate costs from actual business value.

The rise of perverse incentives: Wait state monetization

The risk becomes even more acute when external applications weaponize these architectural inefficiencies. Emerging platforms that we will choose not to name or publicize here demonstrate exactly how the market is shifting. These tools have begun to let developers monetize the wait states of AI agents. When a coding assistant takes time to process a massive repository, the software replaces the idle loading spinner in the developer environment with a sponsored text advertisement, splitting the ad revenue directly with the user.

Consider the severe security and financial contradiction this introduces to an enterprise. A developer is now financially rewarded for running massive, slow, unoptimized AI queries because longer computational delays generate more personal ad revenue. The employee pockets the cash while the company, footing the token invoice, bears the financial burden. It changes token waste from an accidental engineering oversight into a personal monetization strategy at the expense of the corporate budget.

The training gap

Here's the gap almost no one has closed. Every company has trained employees to use AI, but almost none have trained them to use it efficiently. Most users cannot tell you the difference between a chat assistant, an in-editor copilot and a full agentic tool or when a lightweight model would answer the question for a fraction of the cost of a flagship one. Some people gravitate to the most powerful, most expensive tools simply because they assume that is where the serious work happens. Token literacy, model selection, caching and knowing when not to invoke an agent at all are now fiduciary skills; they’re missing from every onboarding deck I have seen.

The strategic path forward

To survive the token economy, CISOs and CFOs must bridge the gap between security, finance and AI engineering.

• Token literacy training. We don’t just need to teach employees how to talk to AI; we need to teach them token FinOps. Knowing when to route a query to a lightweight, inexpensive model versus a flagship, high-cost model is a critical fiduciary skill.

• Real-time rate limiting. Treat AI API keys like high-value financial assets. Implement real-time token throttling, hard session caps and anomaly detection that shuts down spikes in minutes, not billing cycles.

• Value-based metrics. Banish consumption metrics from performance reviews. Focus on outcomes per dollar spent, not tokens burned.

• The AI governance committee's mandate. Token bleed has no natural owner. It sits in the seam between security, finance and engineering, so it falls through the cracks of all three. This is the AI governance or steering committee's job, and most have never put it on the agenda. Give the committee three explicit duties: make consumption a standing risk alongside data privacy and adoption; set the policy on approved models, per-agent ownership and kill-switch authority; and own the metric decision so token volume never becomes a performance target. The committee's role is guardrails and visibility, not arbitrary caps. Done well it moves the organization to Phase 3; done as panic it traps it in Phase 2.

• A deliberate MCP server strategy. Every MCP server runs under an identity with a scope, so an over-permissioned server is at once a data blast-radius risk and a token-bleed risk. It can reach more, do more and burn more. The same discipline that shrinks the blast radius, scoping the server's identity and toolset tightly, also bounds its consumption. The servers you run become the metering chokepoint for per-agent spend. MCP governance is a security control and a cost control at the same time. 

AI offers unprecedented velocity for business growth but, if left unmonitored, it can lead to financial ruin at a similar speed.

Implementing the live operating model

To actually manage this risk, organizations must establish a shared operational communication channel that bridges the gap between security and finance, explicitly bringing the CFO into the room. The initial insights from this unified approach are invariably eye-opening. While the top token spenders will likely be your senior engineers, which represents healthy innovation, the true strategic signal lives further down the consumption list.

Companies deploying this model often surface anomalies, such as a single user in a frontline business unit running unusually hot, which warrants immediate investigation. At Priceline, a CTO discovered a single engineer had run up forty thousand dollars in token charges in one month. More frequently, they flag nontechnical staff members driving massive spending, not out of malice, but by uploading large files into long sessions without realizing a cheaper, faster path exists. This isn’t insider threat activity. This is a clear training gap with a direct financial penalty attached, and leadership can only catch it if they monitor the right operational metrics.

The ultimate goal is to wire per-user consumption details into a weekly automated reporting job that surfaces spend anomalies directly to the executive team. This shifts the financial review process from a retrospective quarterly postmortem into a continuous operational practice that takes minutes.

The same blind spot that hides a runaway token bill hides something larger: what those nonhuman and AI agent identities can actually reach. Spend is only the first readout. The moment you can see which identities are consuming the most, you’re one step from the more important question of what data those identities can touch. The token invoice and the data blast radius are two symptoms of the same missing control: visibility into what your autonomous systems are really doing.

Looking up the curve: Token futures and hedging

Finally, look up the curve. Airlines don't pray that fuel stays cheap; they hedge it with futures. As AI becomes a core input cost, expect companies to start buying tokens forward in exactly the same way. The pricing signals are already shifting. While the unit cost of basic tokens steadily drops over time due to raw efficiency gains, total enterprise consumption is exploding exponentially due to autonomous agents. At the same time, the latest frontier models prove that organizations will always pay a massive premium for advanced frontier reasoning capabilities. 

Organizations that treat token cost as a managed commodity, with forecasting and procurement discipline, will outpace those still being surprised by the monthly invoice.

The market is already moving to formalize this. In 2026 the Linux Foundation launched the Tokenomics Foundation, a standards body modeled on FinOps for cloud, to set shared definitions, open standards and metrics for AI token usage and billing. When an industry stands up a foundation to standardize how a cost is measured, that cost has graduated from a line item to a discipline. Token FinOps is becoming a named practice; the organizations that adopt it early will set the terms the rest inherit.