Response max_tokens is explicitly set on all AI API calls

Without an explicit max_tokens ceiling, the model may generate up to its remaining context window in a single response. A model in a repetition loop or producing unexpectedly verbose output runs until it hits the absolute limit — billing you for every token generated. On a high-traffic endpoint, a single user who triggers runaway generation can produce a spike equivalent to thousands of normal requests. OWASP LLM10, CWE-770, and CWE-400 all apply. NIST AI RMF GOVERN 6.1 requires operational controls on AI resource consumption; max_tokens is the most direct such control.

Set maxTokens on every streamText, generateText, and chat.completions.create call. Calibrate the value to what the task actually needs — a chat reply does not need the same ceiling as a document draft.

// Vercel AI SDK
const result = await streamText({
  model: openai("gpt-4o"),
  messages,
  maxTokens: 1000, // sized for a chat reply; increase for long-form tasks
});

// OpenAI SDK directly
const completion = await openai.chat.completions.create({
  model: "gpt-4o",
  messages,
  max_tokens: 1000,
});

Verify by searching the codebase for all streamText, generateText, and chat.completions.create call sites and confirming each has an explicit maxTokens or max_tokens property — not the model's absolute maximum.