Why do agentic systems break traditional token cost models?

Traditional models assume one request equals one model call, but agents fan out into retrievals, retries, tool invocations, and sub-agent runs. That makes token consumption non-linear and difficult to predict with spreadsheets. The result is hidden cost growth unless telemetry is tied to the full execution path.

Why This Matters for Security Teams

Agentic systems do not consume tokens like a single chat prompt. They create chains of model calls across planning, retrieval, tool use, reflection, and retries, so the real cost surface includes every step in the execution path. That matters for security teams because cost blowouts can signal weak governance, missing guardrails, or unapproved autonomy in production. The NIST AI Risk Management Framework is useful here because it treats AI risk as a lifecycle issue, not just a model-output issue.

The common mistake is to budget only for obvious prompt volume and ignore tool fan-out, sub-agent orchestration, and repeated context expansion. In practice, that turns cost into an operational control problem, not just a finance problem. Security leaders also need to think about whether hidden retries are masking prompt injection, unstable tool responses, or poor agent design. The token bill is often the first visible symptom of broader control failure. In practice, many security teams encounter runaway agent cost only after production autonomy has already widened the attack surface.

How It Works in Practice

Traditional LLM usage is often measured as input tokens plus output tokens per request. Agentic systems break that assumption because one user action may trigger multiple model passes, each with its own prompt history, retrieved context, and tool output. A planner may call a search tool, a summariser may re-read results, and a controller may ask for validation before execution. Each of those steps adds tokens, and each can multiply again if the system retries or branches.

Practitioners should instrument the full execution graph rather than the final response only. That means tracking:

• prompt assembly, including hidden system and policy context;
• retrieval volume and how much text is injected back into the model;
• tool calls, retries, and exception handling paths;
• sub-agent delegation, especially where tasks recurse or fan out;
• per-step cost, latency, and confidence thresholds.

This is also where agentic security and cost governance overlap. The OWASP Agentic AI Top 10 highlights risks such as excessive agency, insecure tool use, and poor output handling, all of which can amplify token spend. The same execution paths that inflate cost can also enable prompt injection, data leakage, or unintended action. Mature teams therefore couple spend controls with policy limits, approval gates, and telemetry that can attribute cost to a workflow, not just a user. These controls tend to break down when agents are allowed to self-retry against unstable external tools because the recursion hides the true request count.

Common Variations and Edge Cases

Tighter cost control often increases engineering overhead, requiring organisations to balance observability against speed of iteration. That tradeoff is especially sharp when agents are used for research, SOC support, or software delivery, where autonomy and variability are part of the value proposition.

Current guidance suggests a few recurring edge cases. Long-context RAG workflows can appear cheap at low volume but become expensive when every turn rehydrates large documents. Multi-agent systems can also distort costs because one visible task may hide several internal model calls. There is no universal standard for pricing these flows yet, so teams typically define internal allocation rules based on workflow, environment, or business unit rather than raw chat session.

Another edge case is safety review. Some organisations add critique loops, policy checks, or human-in-the-loop validation, which can raise token use but reduce downstream risk. That can be a rational tradeoff if the agent handles sensitive actions or regulated data. The practical question is not whether agents use more tokens than chatbots. It is whether the added spend is intentional, measured, and justified. The MITRE ATLAS adversarial AI threat matrix and the CSA MAESTRO agentic AI threat modeling framework both reinforce the need to model how autonomy, tool access, and attack paths interact, because the same mechanics that raise cost can also raise adversarial risk.

Related resources from NHI Mgmt Group

• Why do agentic AI systems break segregation of duties models?
• Why do agentic AI workflows break traditional least-privilege models?
• Why do agentic AI systems break traditional compliance frameworks?
• Why do agentic AI systems complicate traditional recovery and access review models?