A discount marketplace for LLM tokens has quietly grown into a full-blown fraud ecosystem, and it’s changing how developers think about exposing their AI apps. According to Simon Willison, who flagged a detailed investigation by Matt Lenhard, resellers are pooling API keys from many sources and selling access to large language models at steep discounts through proxy servers. The activity looks to be concentrated in China. What stands out here is how organized it’s become: this isn’t a few hobbyists sharing keys, it’s a working market with buyers, sellers, and off-the-shelf software.
How the scheme works
The mechanics are simpler than you’d expect. Resellers sell access to an LLM proxy that undercuts official API pricing, and they fund those discounts through abuse. Simon Willison reports the supply comes from a mix of methods:
- Abusing free trials across many accounts
- Proxying requests through unprotected customer support bots
- Stolen credit cards and chargeback attacks
The tooling is legitimate, which is what makes this hard to stamp out. The proxies run on open source software, mostly one-api and its more active fork new-api. Both are real, above-board products built to load-balance requests across a pool of API credentials. In the wrong hands, that same load-balancing turns a pile of stolen or trial keys into a single cheap endpoint.
Who’s buying, and why
The demand side tells you a lot about where the market is going. Buyers aren’t all fraudsters themselves. According to the investigation Willison cites, they’re after three things:
- Cheap tokens at a fraction of list price
- Bypassing geo-restrictions that block them from official access
- Collecting data for model distillation, meaning they use one model’s outputs to train or sharpen another
That third motive is the one worth watching. Distillation through resold tokens is a quiet way to extract value from frontier models without paying frontier prices, and it points to a competitive dynamic that vendors can’t ignore.
Why it matters now
The bigger story is exposure. Any developer running a public LLM feature is now a target, not by accident but by design. “There’s now an entire ecosystem that can profit from finding a new unprotected endpoint to exploit,” Willison writes. He admits the marketplace makes him more cautious about shipping his own AI apps publicly, out of fear that abuse leads to a surprise token bill.
That fear is rational. If a stranger routes thousands of requests through your leaky endpoint, you eat the cost. The fraud market has industrialized the hunt for exactly those endpoints, so the odds of getting found went up.
The fix vendors keep dodging
Willison’s sharpest point is aimed at the model providers themselves. He argues LLM vendors need to get much better at strict spending caps on API keys. His ask is blunt: he wants his apps to stop working the moment they hit a dollar threshold he’s set for a given period.
Right now most providers offer soft limits, delayed billing alerts, and dashboards you check after the damage is done. A hard, real-time kill switch tied to a dollar figure would defang a lot of this abuse in one move. Until that ships, the risk sits with developers.
Practical takeaways
If you run or plan to run public AI features, a few moves reduce your exposure:
- Set the tightest budget alerts your provider allows, and check whether any hard cap exists
- Put your own rate limiting and auth in front of every LLM endpoint, never expose a raw key path
- Rotate keys often and scope them narrowly so one leak doesn’t drain your account
- Watch support bots and internal tools, since those unprotected surfaces are exactly what resellers proxy through
- Treat trial and free-tier abuse as a threat model, not an edge case
The underground token trade is a signal of how mature, and how adversarial, the AI infrastructure layer has become. The pressure is now on providers to make spending caps a first-class feature rather than an afterthought. You can read Matt Lenhard’s full investigation, and Willison’s commentary, at the original source.