Tokenmaxxing Left the Keys in the Door

Every hangover ends with an inventory. I went looking for tokenmaxxing’s.

The binge is well documented. In March 2026, Nvidia chief executive officer Jensen Huang said he would be “deeply alarmed” if a USD500,000 engineer did not burn USD250,000 on AI tokens. In April 2026, Meta pulled “Claudeonomics,” an employee-built leaderboard of its top 250 token users. It came down two days after the news broke. Uber spent its entire 2026 AI coding budget in four months, then capped each employee at USD1,500 a month per coding tool. Amazon scrapped its own leaderboard after staff pointed agents at pointless work to climb it.

Finance saw all of that. The invoices were the obvious crime but I wanted the part finance cannot see.

So I sat down virtually with Tim Wedande, senior vice president and field chief technology officer for Asia Pacific and Japan at Saviynt and, until recently, an EY partner running identity security programs for regulated clients in the UK and Europe. Saviynt sells identity security, so he has a stake in what I would find. He also told me where current products fall short.

The residue is access, not spend

Push engineers to maximize tokens without guardrails, Wedande said, and “it leaves a big footprint on the access side of hyper privilege.” Agents built in those months got admin accounts, “which was almost always the case.” They also got long-lived API and OAuth tokens. “They’re still hanging around today.”

Amazon is the tell. Its leaderboard tracked MeshClaw, an in-house agent that can start code deployments, triage email and act in Slack. Amazon replaced the leaderboard with a better metric. Nobody said what happened to the credentials.

Tokenmaxxing looked like a cost problem. It was an access problem too, and it outlived the budget meeting.

The crime with no stolen key

Overprivileged accounts create the loudest noise when it comes to damages. The next one is quiet, and it lands closer to the data office.

A customer service agent pulls a customer’s spending data and shows it back to them. Useful. Then the same data feeds a campaign selling that customer broadband. No credential was stolen, the model behaved and the permissions were correct. Only the purpose was wrong, and in some markets that is a regulatory finding.

No CISO catches this one, Wedande said. A support agent may close tickets but should not touch employee records. Data collected for one purpose should not be reused for another. “A CISO won’t be able to draw that out,” he said. Those are data boundaries, and the data owner writes them.

This is where the CISO’s remit ends. Identity tools enforce the rule but someone else has to write it.

No owner, no inventory

Writing that rule assumes you know which agents exist. Most companies do not.

Agents shipped “like a development script,” Wedande said. Each got an admin or service account, no expiry date, and often an account shared with other agents. People get joiner, mover and leaver workflows fed by HR. Agents get nothing, and HR will never tell you an agent quit.

Ownership disappears fast. The builder was a contractor, or has left. Agents spawn child agents with the same privileges. “Often agents don’t have physical, sort of, heartbeat owners,” he said.

“Often agents don’t have physical, sort of, heartbeat owners.” – Tim Wedande @ Saviynt

His first question to customers across Asia is whether they can see the agents running in their enterprise. The usual answer: no inventory exists, sanctioned or otherwise. The data agrees. Machine identities, agents included, now outnumber humans 109 to 1, according to a Palo Alto Networks survey of more than 2,900 security decision-makers. EY found 26% of organizations using agentic AI cannot detect unauthorized agents.

Here the CDO has an advantage nobody else has. Security can list the accounts. Only the data catalog says what those accounts were touching, and which of it was regulated. An unowned agent is a security finding. An unowned agent inside customer records is yours.

Wedande’s field test for hidden agents is simple. Look for read-write queries running at higher concurrency than the number of agents you believe you have.

The false alibi

A full inventory still leaves one comfortable belief standing: that a secure model makes a secure agent.

Model filters screen what goes into and out of the LLM, Wedande said, and that “is a small part” of the exposure. They will not catch an agent whose intent drifts, a prompt injection that triggers extra access, or a compromised orchestration library.

His example is payroll. A payroll officer asks an agent for all Thailand salary data. Fine. A regular employee invokes the same agent, and it should return only that person’s record. Add rules on whether the data can move to Singapore, and the policy multiplies. Across APJ, he said, there is “very, very little” downstream authorization of agents.

McKinsey, which calls agents “digital insiders,” found 80% of organizations have seen risky agent behavior, including improper data exposure. Confidence runs ahead of control: 94% of IT and security leaders say their agents have no more access than they need. Only 33% provision least privilege.

The missing tape

Drift and injection are security problems. The next one lands on a CDO’s signature.

Agents are already approving low-risk access reviews. When an auditor asks why one approval was low risk at that moment, Wedande said, you have to show the reasoning, and you have to capture that evidence as it happens. Without a gateway recording intent, timing and the invoking user at the moment of action, you are stitching logs together from the API, the LLM and whatever sits between them. “It is very difficult to do that reactively,” he said.

“Long-lived API and OAuth tokens... they’re still hanging around today.” – Tim Wedande @ Saviynt

An audit trail cannot be rebuilt later. Few companies capture it now. Deloitte found only 21% have mature governance for agentic AI, and audit trails covering the full chain of agent actions are among the capabilities most of them lack.

Australia starts a clock on Dec. 10. From that date, organizations must state in their privacy policies where computer programs make decisions that significantly affect people. That is a duty to disclose, not a duty to explain, and the new AI Safety Institute advises government and does not enforce.

Closing the case

So what does week one look like? Wedande’s sequence may appear dull but is why it works. Discover every agent and give it a human owner. Apply lifecycle controls: automatic expiry, since no HR system will offboard an agent, and access reviews triggered when an agent’s access drifts. Then enforce at runtime.

That last step retires two habits built for humans. Fixed role-based access gives way to policies that judge each transaction against what the agent was designed to do. Just-in-time access drops the human approver and becomes a credential for one API call that expires by itself. “It doesn’t even need to be revoked,” he said.

Vendors will tell you one gateway covers all of this. Content, routing and identity authorization gateways do different jobs, Wedande said: “I’ve yet to see one that ticks every single box.” His own Zuma platform works the identity layer. Separation of duties (SoD) between agents, so one cannot raise an invoice that another approves, is still in testing.

Gartner expects 40% of enterprises to demote or decommission autonomous agents by 2027, because governance gaps surface only after something breaks in production. The leaderboards are gone. The credentials they minted are the evidence. Find them before an auditor does.

Image credit: iStockphoto/fcscafeine