Uber burned through its entire 2026 AI budget in four months. An AI consultant’s client spent $500 million in a single month because no one set usage limits on Claude licenses. Microsoft — which has P&L on both sides of the AI tooling trade — is cutting its own Claude Code subscriptions.
These aren’t outliers. Every company running AI without a control layer is next.
The industry called this era tokenmaxxing: encourage developers to consume as many AI tokens as possible, measure adoption by consumption, and assume productivity follows. It was never a fringe trend. Jensen Huang publicly said he’d be “deeply alarmed” if a $500K developer spent less than $250K on AI tokens. Meta and Disney built internal token leaderboards. Uber ranked engineering teams by AI tool usage — and then watched its entire annual budget disappear by April.
Now that bill has arrived. And most engineering leaders can’t explain it line by line.
The Fundamental Problem: Input Metrics Don’t Prove Output Value
Token consumption is a measure of input. It tells you the AI was used. It does not tell you what was built, whether it shipped, or whether it was worth the cost.
IBM’s Neel Sundaresan, GM of Automation and AI, put it directly: token consumption is “just one of the many metrics we should use to measure productivity.” At IBM, the average developer spends around $150/month — some power users hit $1,000+ — but the company tracks code quality, lines shipped, PRs merged, bugs fixed, and PR reversals alongside token consumption.
Uber’s situation illustrates what happens without that broader view. Engineers reported monthly API costs of $500–$2,000 per person. About 70% of committed code is now AI-generated. Yet Uber’s COO recently said the link between Claude Code usage and “useful consumer features” is simply not there yet.
More tokens. More spend. Less clarity on value.
This is the tokenmaxxing crisis in one sentence: you can’t reduce payroll if the tokens cost more than the payroll itself.
What Valuemaxxing Actually Requires
The industry is converging on a new frame: valuemaxxing — intentional AI spend tied to measurable business impact. Flexera’s Chief Product Officer Becky Trevino describes it as a shift from “spending more to show AI transformation progress” to “making smarter investments that drive real ROI.”
That sounds obvious. But valuemaxxing isn’t a mindset shift — it’s an infrastructure requirement. You cannot govern what you cannot attribute.
Here’s the practical playbook:
1. Attribution before budgets
A spending cap without attribution is a blunt instrument. Uber’s response to the budget blowout was a $1,500/month cap per employee per tool — an improvement over nothing, but it doesn’t answer the CFO’s real question: which work justified the spend?
Real attribution operates across four dimensions:
- User — which developer consumed the tokens
- Team — which engineering team is responsible for the spend
- Project — which initiative or work item the spend is tied to
- Git repo — which codebase is driving consumption
Without all four, you have a bill. With them, you have an answer — and a basis for budgeting, chargeback, and optimization.
The difference: “the team spent $40K this month” vs. “Alice on the Payments team spent $180 on bug fix PROJ-1244 in the billing-service repo, and $200 on exploratory work with no ticket attached.” The second statement tells you what to act on. The first just tells you it’s too late.
Importantly, none of this requires compromising security to achieve. Attribution at this granularity runs at the proxy layer — the same layer that enforces DLP, content policies, and audit trails. Cost visibility and security governance are the same infrastructure, not a trade-off.
2. Model access by policy, not by honor system
Most tasks don’t need the most expensive model. But without enforcement, developers default to the frontier model — because it’s easier, faster, and the cost isn’t theirs to bear directly.
IBM routes developers to appropriate models by task complexity. This isn’t about restricting access; it’s about right-sizing. A code completion task doesn’t require Opus. A complex multi-step reasoning task might. Policy-controlled model routing makes this automatic rather than asking developers to self-regulate.
3. Session budgets with managed overruns
A session is a time-bounded, purpose-scoped authorization to consume tokens on behalf of a specific work item. A developer starts one tied to a ticket. The proxy enforces a budget. Overruns go to a manager approval queue — not a hard stop that breaks the workflow, but a human checkpoint that creates accountability.
This is the mechanism that prevents runaway agents. Not after the fact, in the monthly billing cycle. Before the spend occurs.
4. Real-time visibility, not lagging dashboards
Most native tooling gives aggregate spend with a 24-hour delay. By the time the dashboard shows the problem, the budget is gone. Real-time per-developer, per-session cost data is the difference between governance and forensics.
Most teams treat visibility as the destination. It isn’t. Knowing $40K was spent last month doesn’t recover the $15K lost to runaway agents, model tier misconfigurations, or prompt retries — it just documents it. Valuemaxxing requires an enforcement layer that acts before the spend occurs, not a dashboard that reports it afterward.
What This Means Practically
Uber’s $1,500/month cap is a start. But a cap applied uniformly across developers, teams, models, and task types is a governance approximation, not a governance solution. It will underspend on high-value work and fail to catch waste on low-value work simultaneously.
The engineering teams that navigate this well will build three capabilities in sequence:
- Identity-aware attribution — every token spend tied to a developer, a team, and a work item
- Policy-controlled model access — right model for the task, enforced by role and context, not by preference
- Pre-execution budget enforcement — session budgets that stop overruns before they become billing events, with human-in-the-loop escalation for exceptions
This is exactly what we built Nirmata AIControls to deliver — and it doesn’t require choosing between cost control and security. The same proxy layer that attributes every token to a developer, team, project, and Git repo also enforces DLP policies, blocks prompt injection, and maintains a full audit trail. You don’t get cost governance at the expense of security posture. You get both from the same enforcement point.
The problem isn’t that your developers are using too much AI. It’s that you can’t yet tell which of that spend was generating value — and which of it was burning budget with nothing to show for it.
The budget conversation is happening whether you’re ready for it or not.
Further Reading
- Why Tokenmaxxing Is Out And Valuemaxxing Is In — Forbes, Tim Keary (June 2026)
- Uber burned through its entire 2026 AI budget in four months — TechCrunch (June 2026)
- Uber COO questions whether AI spend is worth it — Fortune (May 2026)
