What: Gartner's top strategic predictions for 2027 and beyond identify cost exhaustion attacks on public-facing AI as a new cybersecurity risk, alongside forecasts of dedicated functions and real-time controls to tie AI spending to value.

Why it is important: With AI budgets already overrunning before any attack, Gartner's predictions shift cost control from retrospective reporting to real-time governance shared by finance, technology and security teams.

Gartner unveiled its top strategic predictions for 2027 and beyond at its IT Symposium/Xpo on the Gold Coast, grouped into three categories: robots everywhere, cost to value and unknown unknowns.

Among the ten predictions, Gartner expects 80% of organisations with public-facing AI to have experienced a cost exhaustion attack by 2030. Malicious actors deliberately drive excessive AI usage to raise operational costs, so token consumption becomes both a cost and a security concern. Gartner recommends making AI token costs a cybersecurity indicator, implementing cost-focused security controls and extending monitoring across all AI technologies.

Cost governance runs through several other forecasts. By 2029, 60% of organisations deploying AI will have a dedicated function mapping total AI cost to value or profit, and by 2028, 60% of Global 500 companies will embed AI FinOps controls at inference, with cost per task and token efficiency becoming core measures.

Further predictions include more than 10 billion autonomous agents clogging public services by end 2030, physical AI assisting 80% of front-line workers at international companies, insurers rather than regulators driving AI governance, and 80% of new applications becoming disposable by 2029.

IADS Notes: Rising AI bills were already a governance problem before attackers entered the picture. McKinsey, July 2026 found that 93% of companies surveyed exceed their AI budgets, with spend rising nearly fourfold as adoption scales, and called for FinOps practices applied to AI. BCG, July 2026 argued that token costs can no longer sit inside IT budgets and proposed cost per successful outcome as the measure of return. ERE Media, June 2026 warned that providers are pricing AI below cost, while agentic systems consume ever more tokens even as unit prices fall, so total bills keep rising. On the security side, Bloomberg, August 2026 reported that AI is lowering the barrier to sophisticated attacks and widening the pool of potential attackers. Public-facing AI also carries reputational exposure: The Robin Report, April 2026 described how a malfunctioning customer chatbot at Woolworths quickly drew public attention and raised doubts over the reliability of digital customer service.

Gartner names AI cost exhaustion attacks among its top predictions for 2027