The Gray Market for Tokens: How LLM Access Gets Resold at a Discount

Simon Willison drew attention to an investigation by Matt Lenhard into a curious shadow market: intermediaries resell access to large language models at a substantial discount off the official rates. The phenomenon appears to be most widespread in China.

How it works

The scheme is built around proxy servers that pool many API keys from different sources and balance requests across them. Sellers deliver the discount not through efficiency but through abuse: exploiting free trial periods, proxying requests through unsecured service bots, and sometimes through stolen bank cards or chargeback attacks.

Notably, the tooling here is legitimate open-source software. This refers first and foremost to the one-api project and its more actively developed fork, new-api. These are perfectly lawful API proxies designed to distribute load across a pool of credentials; the problem lies not in the code itself but in how it is used.

Who buys it

Buyers are after several things: cheap tokens, circumventing geographic restrictions, and in some cases collecting data for model distillation — that is, training their own systems on the outputs of someone else's.

A warning for developers

Willison uses this story as the occasion for a broader caution. He admits he was already wary of publicly exposing his LLM-based applications: an unsecured access point easily turns into an unexpectedly large token bill. The existence of an entire market whose participants professionally hunt for such vulnerable endpoints and know how to profit from them makes that caution all the more justified.

Hence his central conclusion, addressed to the model providers: the industry sorely lacks strict spending limits on API keys. A developer wants to be able to set a dollar threshold for a given period — and to be confident that the application will simply stop working the moment that threshold is reached, rather than keep racking up charges.

The main source for Lenhard's article, it is noted, was a thread on a Chinese-language forum.

Source: Simon Willison