The hidden cybersecurity risks behind tokenmaxxing
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
The past two years have seen unprecedented adoption of generative AI. This was driven largely by LLM platforms such as Claude, which reported 28 million paying US customers in March.
In the corporate world and startups, this has put the pressure on companies to invest in AI, to keep up with the latest models and bolster productivity and efficiency. But now that the world has adopted AI, a stark readiness gap is emerging as governance and AI skills lag behind. AI fluency is now a baseline expectation for employees as leaders feel the pressure to prove the returns on their hefty investments.
Tokenmaxxing is the latest AI trend to come under fire as businesses want employees to use more AI in their work. In essence, this means boosting AI input to maximize AI output. On the surface, it sounds efficient and harmless. But underneath, it poses major security risks.
A ‘token’ is a unit of data processed by an AI model. For example, a word or character inputted into an LLM search. So ‘tokenmaxxing’ quite simply means over-engineering generative AI prompts to get the most out of one search input. This can be anything from overly detailed prompts, to overloading an LLM chat with information, to asking an AI model for step-by-step breakdowns, as opposed to short summaries.
The trend is driven by businesses as leaders face pressure to prove the ROI of AI. It became a tongue-in-cheek benchmark of AI performance. Some companies, such as Meta, even gamified tokenmaxxing, measuring and ranking AI usage and citing the highest scorers ‘Token Legends’.
Their assumption is that AI usage means being AI-forward. But instead, companies need to consider the value they get from AI tools. They also need to keep security at the center of the conversation.
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Although it might look like harmless corporate showboating, this trend poses a wide range of security risks given that LLM vendors are 52% more likely to be designated as “high risk” than traditional SaaS. This is due to access to sensitive data, IP, and internal workflows, so it’s imperative that businesses have oversight of how employees use these resources.
Rapid adoption of AI has led to an experimentation mindset. This is a positive shift from an innovation standpoint, but from a compliance perspective, a ‘trial and error’ approach is more error than trial.
The legacy tech systems most major enterprises are still reliant on are controlled by procurement and security teams and were not designed for the agility of AI technology. Meaning both innovation and compliance are lagging behind. It’s the latter that’s causing major concerns in the cybersecurity world.
When employees face mounting pressure to get the job done, they won’t wait for security teams to approve new tools, which results in shadow AI. This is where unmanaged, unapproved AI tools operate inside company environments without oversight.
Industry data shows that 70% of 16k cybersecurity customers currently have some form of shadow AI lurking within their organization, largely due to AI tools introduced through improper procurement channels that now have access to company data without oversight or guardrails.
There’s also been a 36% increase in shadow IT year-on-year, with organizations discovering, on average, around 140 Shadow IT tools accessing their environment within 90 days of connecting to the platform.
