Token limits are constraints on how many tokens a model or service will accept as input, generate as output, or process over a given period. In an AI system, tokens are the text units used to measure prompts, replies, and context. Limits may apply per request, per session, per user, or per minute, and they help control compute cost, latency, and system load.
In cyber security, token limits are a basic abuse-control measure. They reduce prompt flooding, large-scale scraping, and automated content generation, and they can limit how much sensitive text a user can push through a model at once. Attackers may try to exhaust quotas, send oversized prompts, or chain requests to bypass controls. Defenders combine token limits with rate limiting, output caps, authentication, and anomaly detection so the service stays usable without becoming an easy target for mass abuse.