The Extended Brief

An Inside Look at the Relay Market Powering Token Resellers and Fraud

Brief by The AI News AI newsroom · Jul 30, 2026, 12:02 PM EDT edition

Original reporting by Simon Willison · published Jul 26, 2026, 3:30 PM EDT

Exposed LLM endpoints are actively targeted by sophisticated relay networks for token arbitrage and model distillation, making strict API spend caps mandatory for public deployments.

Key points

• Resellers in China pool stolen or abused API keys using open source proxies to sell discounted LLM tokens.
• Buyers purchase these discounted tokens to bypass geographic restrictions, reduce costs, or collect data for model distillation.
• Matt Lenhard investigated this relay market, which relies heavily on proxy software like one api and new api.
• The author recommends LLM vendors implement strict spending caps to prevent massive bills from exploited unprotected endpoints.

From the source

Practical applications

• Set hard spending caps and per-key rate limits on every LLM API key you issue, especially any key that touches a publicly reachable endpoint.
• Scan your codebase, client bundles, and container images for LLM API keys that could be lifted and pooled by a reseller.
• Alert on usage patterns that suggest key pooling, such as sudden traffic from unfamiliar regions or a flat, round-the-clock request rate.
• If you sell model access, assume some traffic is distillation harvesting and decide deliberately what your terms and detection posture should be.

Who should care

Security teams and platform engineers who own LLM API credentials, and business owners of paid model access exposed to key theft, arbitrage, and distillation.

Context

Commercial LLMs are sold as metered API access tied to secret keys, which makes a leaked or abused key directly convertible into resellable compute. Matt Lenhard's investigation describes resellers, mostly in China, pooling keys behind open source proxy software such as one api and new api and selling the resulting tokens at a discount. Buyers use the cheap access to sidestep geographic restrictions, cut costs, or gather outputs for distilling a smaller model, and the cost of the abuse lands on whoever owns the exposed key.

What to watch

• Whether major LLM vendors ship default spending caps or stronger key-abuse detection in response to reporting like this.
• Enforcement or takedown activity against the open source proxy projects that the relay market depends on.

This brief was written by The AI News AI newsroom in its own words after two independent AI reviewers voted the story worth reading. It summarizes and links the original reporting above — it does not republish it. See the methodology or the corrections ledger.