Learn the Difference Between Security, AI Tokens
Originally Published: Sept. 17, 2026
By Tracey Birkenhauer, journalist and Chief Impact Officer, STACK Cybersecurity
An employee signs in to Microsoft 365 in the morning, approves a multifactor authentication request, and starts working. Outlook opens. Teams works. SharePoint recognizes the employee. Another password isn't required every time the employee moves between applications.
Tokens help make that possible.
Then the employee opens an artificial intelligence tool, and "token" means something entirely different. The AI system breaks the prompt, uploaded information, and its response into tokens so the model can process them.
Give an AI agent permission to read email, retrieve files, query a database, or interact with another business application, and both kinds of tokens can become part of the same process.
That convergence deserves more attention as businesses connect AI to the systems, identities, and data they already use.
Executive Summary
AI tokens and security tokens share a name but perform different jobs. AI tokens are units of information an AI model processes. Identity and access tokens authenticate users and authorize access to systems and data, and they already power single sign-on, cloud applications, and application programming interfaces, or APIs, that employees rely on every day.
A stolen or forged access token can let an attacker impersonate a legitimate user without ever obtaining a password, and in some cases, stolen authenticated sessions can undermine the protection businesses expect from multifactor authentication, or MFA. AI agents raise the stakes further because they often need their own identities, permissions, and credentials to reach email, documents, databases, and customer records. The National Institute of Standards and Technology, or NIST, finalized new guidance on Sept. 15, 2026, for protecting tokens and assertions against theft, forgery, and misuse, and the final publication now addresses AI directly.
One Word Describes Several Different Technologies
"Token" has become one of those technology terms that means very different things depending on who's using it.
An AI developer discussing tokens may be talking about how much text a model can process. An identity engineer may be talking about a credential that authorizes someone to access Microsoft 365. A security analyst investigating an intrusion may be looking for evidence that an attacker stole an access token or an authenticated session.
They aren't interchangeable.
| Type | What It Does | Why Businesses Care |
|---|---|---|
| AI token | Represents a unit of information processed by an AI model | Affects context, usage, and often cost |
| Identity token | Communicates information about an authenticated identity | Helps applications determine who a user is |
| Access token | Authorizes access to a protected resource | A stolen token may give an attacker access to systems or data |
| Refresh token | Can obtain new access tokens without a complete new login | Theft may allow access to persist longer |
| Agent or workload credential | Lets software, services, or AI agents interact with other systems | Excessive permissions can expand the reach of a compromise |
AI Tokens Measure What a Model Processes
Large language models don't process language exactly as people read it. They divide information into smaller units called tokens.
A token might represent a whole word, part of a word, punctuation, or another piece of text. Token counts affect how much information a model can process within its context window and, for many commercial AI services, how much an API request costs.
OpenAI explains that tokenization varies by language and model. As a general approximation for English, one token is about four characters or three-quarters of a word.
For a business using generative AI, these tokens generally affect capacity, context, and cost. They aren't authentication credentials, and confusing the two matters once security and procurement teams start asking what a "token" actually protects.
Security Tokens Keep Users and Applications Connected
Identity and access tokens solve a different problem.
After someone successfully signs in, an identity system can issue tokens that let applications recognize the authenticated identity and determine what resources that identity may use.
Microsoft describes access tokens as security tokens that let applications call protected APIs. The resource receiving the token validates it before granting access.
Tokens also make single sign-on possible. Someone can authenticate once and move among authorized applications without typing a password every few minutes.
That convenience is one reason tokens are valuable to attackers.
Attackers Don't Always Need the Password
Cybersecurity awareness has spent years concentrating on passwords. Use long passwords. Don't reuse them. Use a password manager. Turn on MFA.
Those controls still matter, and many token thefts start with an ordinary credential-harvesting phishing email. Modern authentication, however, creates other credentials worth stealing once an attacker is inside.
A user may enter a password and complete MFA during the initial authentication process. The resulting token or authenticated session lets that person keep working. If an attacker steals a usable token or authenticated session, the attacker may not need to repeat the original login process at all.
NIST describes tokens as a key part of the access management infrastructure at major cloud service providers. They contain cryptographically protected information used during authentication and can enable functions such as single sign-on.
NIST Interagency Report 8587, Protecting Tokens and Assertions from Forgery, Theft, and Misuse, NIST points to the 2023 Storm-0558 compromise. A threat actor obtained a Microsoft signing key and used it to forge tokens, gaining access to Exchange Online and Outlook.com accounts, including at U.S. government agencies. The CISA's joint advisory on the incident urged organizations to enable enhanced logging so similar token abuse could be detected sooner. MITRE's ATT&CK framework catalogs this general category of attack as Steal Application Access Token, technique T1528.
MFA Doesn't Protect Every Part of Authenticated Sessions
MFA remains one of the strongest controls businesses can deploy against password-based account compromise.
It doesn't make token theft irrelevant.
MFA can establish that a user successfully completed an authentication challenge. Afterward, tokens, cookies, or other session artifacts may keep that authenticated session alive.
An attacker who obtains the right authenticated session artifact may be able to impersonate the user without repeating the original authentication process. The result depends on the token, application, identity provider, token lifetime, and security controls in place.
AI Agents Introduce Another Identity Into the Business
Much of the business discussion around generative AI has focused on what employees put into ChatGPT, Microsoft Copilot, Claude, and other AI tools.
STACK has written about that problem in Shadow AI, where employees introduce security, privacy, and compliance risk by using AI tools outside approved company processes.
AI agents expand the issue.
A chatbot that receives a prompt and returns text doesn't necessarily need broad access to company systems. An AI agent that retrieves a SharePoint document, searches customer records, reads email, creates a ticket, updates a customer relationship management system, or executes another business process needs a way to obtain authorized access.
That access might involve OAuth, APIs, service identities, access tokens, API credentials, or another authorization mechanism.
The AI system may now have the ability to act inside the business environment, not just respond to information an employee manually provides.
An AI Agent's Permissions Can Matter More Than Its Prompt
Consider an AI agent authorized to help an employee prepare for customer meetings.
It might need permission to read the employee's calendar, retrieve email, search customer records, access documents, summarize previous interactions, and query another business application.
Each connection creates an authorization decision.
The employee might legitimately have access to all of those systems. That doesn't automatically mean an AI agent should inherit every permission the employee has.
The principle of least privilege, a core idea behind zero trust security, applies to AI just as it applies to human users, administrators, applications, and service accounts. An identity should receive only the access required to perform its job.
NIST is already examining this issue. The final NIST IR 8587 added high-level AI considerations, and the agency's National Cybersecurity Center of Excellence has begun separate work on software and AI agent identity and authorization.
Shadow AI Can Create Shadow Access
An employee using an unauthorized AI application creates one category of risk. Connecting that application to company systems creates another.
OAuth authorization screens can make these connections appear routine. A user clicks "Allow," and an application may receive permission to access files, email, calendars, contacts, or another service.
The employee hasn't necessarily given the application a password. Access has still been granted.
Depending on the permissions, token lifecycle, and application's configuration, that authorization may persist after the employee closes the browser.
This extends a problem STACK has covered in its Shadow AI reporting: a business can't govern applications it doesn't know employees are using.
An AI inventory should go beyond recording the name of an AI product. It should identify:
- who uses the application
- what data employees provide to it
- which company systems it connects to
- what permissions have been granted
- which identities it uses
- whether tokens, API keys, or other credentials are involved
- where those credentials are stored
- how long access remains valid
- how the company can revoke access
STACK's AI Hub addresses the broader governance problem, including AI policy, readiness, security, and shadow AI, and its AI Security Checklist for Businesses walks through the inventory questions above in more detail.
NIST's New Guidance Puts Token Protection on the Security Agenda
NIST and the Cybersecurity and Infrastructure Security Agency (CISA) finalized NIST IR 8587 on Sept. 15, 2026.
The publication is written primarily for federal agencies and cloud service providers, but NIST says the guidance can help any business using identity tokens and related identity assertions.
The report addresses token forgery, theft, and misuse, including the cryptographic keys and systems used to establish trust in those tokens.
NIST revised the final publication after receiving feedback on its December 2025 draft. The changes include broader guidance on cryptographic key protection and storage, additional token revocation options, references to emerging standards, and high-level considerations involving AI and migration to post-quantum cryptography. NIST has covered AI security from other angles as well, including its work on adversarial AI.
NIST's guidance reflects how deeply tokens are embedded in modern IT. They support cloud platforms, APIs, software-as-a-service applications, single sign-on, automation, workload identities, and increasingly AI systems.
Token Security Depends on Identity, Access, and Visibility
Protecting tokens draws on security controls businesses should already have in place.
Reduce Unnecessary Access
Users, applications, service accounts, and AI agents shouldn't receive more access than they need. Privileged identities deserve additional controls because compromise can expose a much larger portion of the environment.
Review Connected Applications
Enterprise applications, OAuth grants, service accounts, API integrations, and AI applications should be inventoried and reviewed on a set schedule. An old integration shouldn't remain authorized indefinitely because nobody remembers who installed it.
Protect Signing Keys, API Keys, and Other Secrets
A stolen individual token can expose one identity or resource. A compromised signing key can undermine the mechanism used to establish trust in many tokens. The Storm-0558 incident demonstrated how much damage that can cause.
Limit Credential Lifetimes
Short-lived credentials can reduce the window during which a stolen credential remains useful. Businesses also need ways to revoke access when compromise is suspected, an employee leaves, an application is retired, or an AI integration is no longer approved.
Monitor Identity Activity
Authentication logs, new OAuth grants, application activity, suspicious sessions, unusual locations, privilege changes, and abnormal access patterns can provide evidence that an identity or credential is being misused.
Put AI Agents Under Identity Governance
An AI agent with access to company systems needs an owner, documented permissions, defined connections, monitoring, and a process for removing its access.
Calling software "AI" doesn't change the security principles that apply to every other identity operating inside the environment.
AI Governance Is Expanding Into Identity Governance
The first wave of business AI governance concentrated heavily on acceptable use. Can employees use ChatGPT? Can they upload customer information? Which AI applications are approved? Can employees rely on AI-generated work?
Those questions remain, but businesses also need to account for access.
Which AI systems can connect to the company environment? Which applications can act on behalf of employees? Which agents can read data? Which can change it? Which can send information outside the company? Which identities, permissions, and tokens make those actions possible?
STACK's work on Shadow AI has focused on discovering and governing AI use because businesses can't secure technology they can't see.
Token management carries that same visibility requirement into identity and access management. Businesses need to know which humans, applications, services, and AI agents can reach their systems and data.
Frequently Asked Questions
Are AI tokens the same as authentication or access tokens?
No. AI tokens are units of information used by AI models to process input and generate output. Authentication and access tokens are used by identity and authorization systems. They share a name, but they perform different functions.
Can someone steal an access token without stealing a password?
Yes. Depending on the system and type of token, an attacker who obtains a usable token may be able to access protected resources without knowing the user's password.
Can token theft bypass MFA?
In some circumstances. If an attacker steals a usable authenticated session or access token after the legitimate user completes MFA, the attacker may be able to reuse that authenticated state without completing the original MFA challenge. The result depends on the identity system, application, token, and security controls involved.
Does single sign-on use tokens?
Common single sign-on architectures use tokens or assertions to communicate authentication and authorization information between identity providers and applications. This lets users authenticate once and then access authorized applications without repeatedly entering their credentials.
What's the difference between an access token and a refresh token?
An access token authorizes access to a protected resource. A refresh token can be used to obtain another access token after the original expires, subject to the identity provider's policies and the status of the underlying session.
Is an API key a token?
Not necessarily. The terms are sometimes used loosely, but API keys and access tokens aren't technically identical. An API key commonly identifies or authenticates an application or calling project. An access token can contain information about an identity, permissions, intended audience, and other claims. Both should be treated as sensitive credentials.
Can an AI agent have an access token?
Yes. AI agents that interact with external systems may use OAuth access tokens, service identities, API credentials, or other authorization mechanisms. The implementation depends on the AI platform and the system being accessed.
Why do AI companies charge by tokens?
AI models process information as tokens rather than billing strictly by words. Many AI APIs charge according to the number of input and output tokens processed, although pricing structures vary by provider and model.
Where are access tokens stored?
It depends on the application and architecture. Tokens may exist in browser sessions, application memory, secure credential stores, servers, mobile applications, or other locations. Tokens shouldn't be exposed in source code, URLs, unsecured logs, or other insecure storage.
Can access tokens be revoked?
Often, but the mechanism depends on the identity system and token design. Some tokens remain valid until they expire unless the underlying session is revoked or the resource has another mechanism for rejecting them. NIST IR 8587 includes guidance on token revocation and signals that can communicate changes in token status.
Need Help Managing AI and Identity Risk?
STACK Cybersecurity helps businesses inventory connected applications, enforce least-privilege access, and monitor for token misuse across identity and AI systems.
Email: info@stackcyber.com
Phone: (734) 744-5300
Contact form