Intel / article

An Inside Look at the Relay Market Powering Token Resellers and Fraud

Source: simonwillison.net
Author: Simon Willison
Date: Published Jul 26, 2026

Context

An exposed AI feature can become someone else's source of resold model access while its owner pays the bill. That is the concern Simon Willison draws from a relay-market investigation: resellers pool access from multiple sources behind a single service.

The linked investigation describes traffic routed through an inadequately restricted support-chatbot endpoint. Willison distinguishes that reported abuse from the legitimate proxy software used to combine access credentials. Willison's request for strict spending caps follows from the billing exposure: an application owner needs a way to stop paid usage when a chosen budget is exhausted, even if requests continue arriving.

Key takeaways · AI-distilled

The resale proxies are ordinary open-source software: one-api and its more active fork new-api, used to load-balance requests across a pool of API credentials. The discount comes from the credentials, not from any clever trick.
The keys are sourced by abusing free trials, proxying through unprotected customer-support bots that quietly forward to a model, and in some cases stolen cards or chargebacks. Any public endpoint left unmetered becomes inventory.
Buyers are not all bargain hunters. Some want to route around geographic restrictions on frontier APIs, and some are collecting outputs to distill their own models.
The concrete ask of vendors is a hard dollar cap per API key that stops serving the moment it trips. Spend alerts arrive after the bill, which is no defense against automated abuse.

Terms in this piece · Glossary

LLM — A large language model — the neural network behind tools like Claude and ChatGPT, trained on huge amounts of text to predict what comes next.
token — The chunk of text a model reads and writes in — roughly three-quarters of a word — and the unit AI usage is billed in.
inference — Running a trained model to get answers — the phase where AI is actually used, as opposed to trained.

Key quotes

“Resellers sell access to an LLM proxy that offers significant discounts on regular API pricing, which they achieve by abusing free trials, proxying through unprotected support bots, or sometimes through stolen credit cards or chargeback attacks.”

“The existence of this marketplace makes me even more cautious: there's now an entire ecosystem that can profit from finding a new unprotected endpoint to exploit.”

“LLM vendors really need to get better at offering strict caps for their API keys.”

“I want my LLM apps to stop working the moment they hit a dollar threshold I've set for a period of time.”

Read the source simonwillison.net