An Inside Look at the Relay Market Powering Token Resellers and Fraud
Simon Willison's Weblog Simon Willison
There's a whole underground market reselling stolen or abused LLM API access at steep discounts. It's mostly running through open-source proxy tools, and it should scare anyone building public AI apps.
Based on reporting by Simon Willison's Weblog, Simon Willison — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Matt Lenhard just published a deep dive into something most people building with LLMs have probably never thought about: an active gray market, concentrated largely in China, for reselling access to AI model tokens at a fraction of retail price. The mechanics are almost mundane once you see them laid out. Resellers stand up proxy servers, pool together a bunch of API keys obtained through free-trial abuse, unprotected support bots, or in the uglier cases stolen credit cards and chargeback fraud, then sell cheap access to that pooled capacity to buyers who don't much care where the tokens came from.
What makes this notable isn't the fraud itself, which is as old as the internet, but the tooling. The proxies running this whole operation are built on open-source software, mainly one-api and its more actively maintained fork, new-api. Both are legitimate load-balancing tools meant to help developers manage and distribute API credentials across multiple keys. Nothing sinister in the code. It's the same story as a lot of dual-use infrastructure: build a tool for load balancing, and someone will eventually use it to launder access to abused accounts at scale.
The buyers aren't a monolith either. Some are just price-sensitive users trying to dodge geo-restrictions or full retail pricing. Others, more interestingly, appear to be gathering large volumes of model outputs for distillation, training smaller models on the outputs of bigger ones without paying the sticker price for the privilege. Lenhard traced a lot of this back to a Chinese-language forum thread, which reads like a functioning marketplace with its own norms, complaints, and vendor reputations.
The practical takeaway is uncomfortable for anyone running a public-facing LLM app. If your endpoint has a soft spot, whether it's a support bot with an exposed key or a free trial with loose limits, there's now a whole cottage industry actively hunting for exactly that weakness, ready to monetize it the moment they find it. This isn't hypothetical abuse anymore. It's organized, documented, and apparently profitable enough to sustain forum communities dedicated to it.
My take — AI-written commentary, not fact-checked reporting
I run small AI experiments and I've always been paranoid about exposing them publicly because of runaway bills, and this piece confirms that paranoia was underrated, not overblown. The real failure here sits with the model vendors: OpenAI, Anthropic, and the rest need hard, real-time spending caps on API keys, not billing alerts that arrive after the damage is done. Until that exists, every unprotected endpoint is basically free inventory for this resale economy, and it's naive to assume nobody's looking.
Read more about this at: Simon Willison's Weblog