Because each new turn re-sends prior conversation state, so earlier file reads are paid for again and again. A single over-read can become millions of re-billed tokens if it remains in the session for hundreds of turns, which is why navigation efficiency matters as much as model quality.
Why This Matters for Security Teams
Long-running AI coding sessions are not just a cost problem. They also create a governance problem, because the agent’s effective context can become a hidden inventory of decisions, code, and credentials references that is repeatedly reprocessed. When an agent rereads old files, large prompts, or stale task history, organisations pay for the same context more than once and increase the chance of outdated instructions shaping current output. That matters for code quality, change control, and auditability.
For practitioners, the important lesson is that token spend is usually a symptom of inefficient session design, not merely a model pricing issue. Good session hygiene means minimizing unnecessary rereads, keeping task scope narrow, and resetting context when the task boundary changes. This aligns with the NIST AI Risk Management Framework, which emphasises governable, measurable AI behaviour rather than treating the system as a black box. In practice, many teams notice the cost curve only after a coding agent has already drifted through a large repository and re-billed the same context hundreds of times.
How It Works in Practice
AI coding agents usually operate inside a conversational loop. Each turn may include a running history, retrieved files, tool outputs, and instructions that must be replayed to preserve continuity. That means earlier reads are not “free” after the first access. If the session keeps growing, every new action can trigger another large context submission, especially when the agent is allowed to browse broadly or retain verbose file excerpts.
The practical cost drivers are usually predictable:
- Large files or directory trees are read early, then carried forward in session history.
- Repeated tool calls surface the same content instead of narrowing to changed files.
- Overly chatty prompts and outputs increase the amount of state that must be resent.
- Long task chains keep obsolete context alive after the work objective has shifted.
This is where agent governance overlaps with security engineering. The same controls that reduce runaway spend also reduce the chance of prompt injection, unsafe tool use, and unbounded autonomy. The OWASP Top 10 for Agentic Applications 2026 is useful here because it treats tool access, context handling, and trust boundaries as first-class risk areas. A well-run agent should search narrowly, summarize aggressively, and discard stale state when the task is complete. These controls tend to break down when the agent is allowed to roam across large monorepos with weak retrieval limits because the session accumulates redundant context faster than it can be pruned.
Common Variations and Edge Cases
Tighter context controls often increase engineering effort, requiring organisations to balance lower inference cost against added orchestration overhead. There is no universal standard for session length, pruning frequency, or reset strategy yet, so best practice is still evolving. Some teams prefer short-lived sessions for bounded tasks, while others rely on resumable state for complex refactors or multi-file debugging.
Edge cases usually appear when the agent must preserve exact prior reasoning, such as security reviews, incident response support, or large refactors that depend on earlier decisions. In those cases, aggressive pruning can reduce cost but also remove needed context, which may lower code quality or increase rework. The better pattern is selective retention: keep only task-relevant summaries, not full transcript history. That approach fits the broader risk lens in the OWASP Agentic AI Top 10 and the control discipline described by the NIST SP 800-53 Rev 5 Security and Privacy Controls. The main tradeoff is simple: more retained context can improve continuity, but it also makes every subsequent turn more expensive and harder to govern.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATLAS address the attack and risk surface, while NIST AI RMF, NIST AI 600-1 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | GOVERN | Session cost is a governance issue because repeated context use needs oversight and measurable controls. |
| OWASP Agentic AI Top 10 | Agentic systems need controls for tool use, context handling, and boundary enforcement. | |
| MITRE ATLAS | Adversarial manipulation of agent context can amplify cost and unsafe behaviour. | |
| NIST AI 600-1 | GenAI profiles emphasize safer operational handling of prompts and model interactions. | |
| NIST CSF 2.0 | GV.OV-01 | Ongoing oversight helps identify inefficient or risky agent behaviour before costs escalate. |
Define ownership, tracking, and review for agent sessions so context growth stays visible and bounded.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
