Summary
- A functioning marketplace — largely operating out of China — resells LLM API access at steep discounts by pooling credentials obtained through free-trial abuse, unprotected support bots, stolen credit cards, and chargeback fraud.
- The infrastructure relies on open-source proxy tools, primarily one-api and its fork new-api, which are legitimate load-balancing products repurposed to aggregate and resell stolen or misappropriated API keys.
- Buyers are motivated by cost savings, circumventing geo-restrictions, and harvesting outputs for model distillation — meaning your exposed endpoint may be training someone else’s model.
- Any publicly accessible LLM-powered application without strict spend controls is a potential target; the existence of this market means unprotected endpoints are actively sought out and monetised.
- LLM providers currently lack robust hard-cap enforcement on API keys, leaving developers and organisations to manage exposure through their own controls.
How the market works
Investigative reporting by Matt Lenhard, highlighted by developer Simon Willison, has documented a structured reseller market built around discounted LLM API access. Resellers aggregate API credentials from multiple sources and sell access through a proxy layer, offering prices well below what major LLM vendors charge directly. The discounts are made possible not by legitimate volume agreements but by sourcing credentials through free-trial abuse, routing traffic through unprotected vendor support chatbots, and in some cases using stolen payment details or executing chargeback attacks against API providers.
Open-source tooling at the centre
The technical backbone of these operations is largely open source. Two projects — one-api and its more actively maintained fork new-api — are the tools of choice. Both are legitimate API gateway and load-balancing products designed to manage requests across a pool of credentials. In this context, they are being repurposed to pool stolen or abused keys and distribute traffic across them, making the arbitrage operation straightforward to stand up and scale. The open-source nature of the tooling means there is no meaningful technical barrier to entry for new operators.
Who is buying, and why it matters
The buyer base is not monolithic. Some are simply seeking cheaper access to frontier models. Others are working around geographic restrictions that limit access to certain LLM providers in their region. A third segment is more concerning from a security perspective: buyers collecting model outputs at scale for model distillation — using the responses to train or fine-tune their own models. If your application is being proxied through one of these relay services, your users’ queries and your system prompts may be flowing through infrastructure you have no visibility into and no agreement with.
The endpoint exposure problem
Willison notes that he has long been cautious about exposing his own LLM-driven applications publicly, citing the risk of abuse driving up token costs. His assessment after reviewing this research is that the risk is higher than previously understood: there is now a mature ecosystem that actively profits from identifying new, unprotected endpoints to exploit. An exposed endpoint is not just a cost liability — it is a commodity that can be packaged and sold to a buyer pool that may have objectives entirely at odds with your own.
A gap in vendor controls
Willison is direct about a structural gap on the vendor side: LLM providers do not currently offer sufficiently granular hard caps on API key spend. The ability to set a firm dollar threshold per key per period — after which the key simply stops working — is not reliably available. Without that control sitting at the provider layer, the burden of preventing runaway spend falls entirely on the application developer or the organisation operating the service. That is a meaningful gap, and it remains unresolved.
Why it matters
For CISOs, this is a cost, data, and reputational risk in one package. Any public-facing LLM application — internal tools with external exposure, customer-facing chatbots, AI-assisted portals — is a potential target for credential harvesting or direct traffic abuse. Beyond the financial impact of unexpected API bills, there is a real possibility that queries processed through a compromised or abused endpoint are being logged, aggregated, and used by third parties for model training. Organisations that have embedded LLM capabilities into customer-facing products need to treat endpoint hardening with the same discipline applied to any other externally exposed service.
What to do now
- Audit all publicly accessible LLM-powered endpoints and confirm they have authentication controls in place — unprotected endpoints are being actively sought out by this market.
- Implement application-level spend monitoring and alerting on LLM API usage; do not rely solely on vendor-side controls, as hard caps are not reliably available across providers.
- Review API key provisioning practices to ensure free-trial or low-limit credentials are not exposed in public-facing applications or repositories.
- Where your LLM provider does offer spend caps or key-level rate limits, enable them and set conservative thresholds appropriate to expected usage.
- Assess whether your current LLM application architecture would allow detection of abnormal query volumes or patterns that could indicate your endpoint is being used by third parties.
