What happened
The Canadian Centre for Cyber Security published Managing AI token consumption for operational resilience (ITSM.00.125), dated October 2026 and last modified October 22, 2026. It explains that pay-per-token AI services can run out of quota or budget, and that attackers can deliberately burn an organization's tokens through automated prompts, abuse of public AI interfaces or self-feeding AI loops (denial-of-tokens and denial-of-wallet attacks). It recommends usage baselines and tiered alerts, feeding token telemetry into a SIEM, AI gateways or proxies to enforce quotas, multi-provider fallback, and human sign-off for consequential AI-driven actions. (Canadian Centre for Cyber Security: ITSM.00.125, Oct. 22, 2026)
What it means for Canada
This is official Canadian guidance aimed at organizations of every size and sector, with specific advice for critical infrastructure operators and cyber defenders. Any Canadian firm running public chatbots, AI agents or pay-per-use model APIs can lose service or money if quotas are drained, and the Cyber Centre says abnormal token spikes should be treated like abnormal bandwidth: a possible sign of data theft.
- Sectors
- Critical infrastructure operators (energy, telecom, transport, finance) · Banks and insurers · Government departments and Crown corporations · Retailers and telcos running public AI chatbots · AI startups reselling model APIs
- Tools involved
- Third-party LLM APIs billed per token · Public-facing AI chatbots and assistants · Agentic workflows with multi-step tool calls · AI gateways and proxies
- Canadian rules
- Bill C-8 (Critical Cyber Systems Protection Act): designated operators in federally regulated sectors must run cyber security programs, so AI dependencies in critical systems belong in that program
OSFI B-13: federally regulated financial institutions must manage technology and cyber risk, including the availability of third-party services such as AI APIs
OSFI E-23: model risk management expectations cover AI models institutions rely on
PIPEDA: if a token spike turns out to be data exfiltration involving personal information, a breach with a real risk of significant harm must be reported to the Privacy Commissioner
Takeaways for Canadian businesses
- BusinessSet tiered token alerts on every AI account, as the Cyber Centre suggests: information at 70% of quota, warning at 80% and critical at 90%, routed to a named contact.
- BusinessSend AI token telemetry to your SIEM and correlate it with identity, cloud and API logs, so an unexplained spike is investigated as possible data exfiltration.
- BusinessPut public chatbots and agents behind an AI gateway or proxy that enforces per-key quotas, caps output length and bounds agent loops, to blunt denial-of-wallet attacks.
- BusinessMap which critical operations depend on an AI provider and configure a second provider or a manual fallback, with human authorization required for consequential AI actions during outages.
- BusinessBefore signing an AI contract, check the provider's quota limits, rate limits and service levels against your expected peak demand, as ITSM.00.125 recommends.
For the Canadian AI sector
The guidance pushes Canadian AI buyers to treat token budgets as a security control, not just a finance line, which favours vendors that offer quotas, per-key limits and usage telemetry. It also explicitly points organizations to smaller or locally run models from trusted sources where they meet the need.
Written by AgentsNorth from the source below. General information, not legal or security advice.