Vectoral Maps the LLM Token Relay Market and Its Fraud Risks
Vectoral published a June 28 investigation mapping how Chinese “relay” services pool and resell access to U.S. AI models, sometimes at discounts as high as 97.8% from official list prices. The report traces a four-layer supply chain and documents abuse methods including free-trial farming, chargebacks, stolen cards and exposed application endpoints. It recommends layered controls while noting that relay software itself can be legitimate.
Vectoral published an investigation on June 28 into a market for third-party services that proxy access to U.S. AI models. Simon Willison highlighted the report on July 26, drawing fresh attention to the operational and security risks it describes.
What the investigation found
Vectoral researcher Matt Lenhard describes a four-layer supply chain: merchants supplying payment cards and accounts, pools aggregating credentials and rate limits, customer-facing relay services, and developers or businesses buying discounted inference. The investigation says one tracked offer provided the equivalent of $3,333 in official Anthropic credit for 425 yuan, and its price comparison placed the deepest observed discount at 97.8% below official list pricing.
Those figures come from Vectoral's own tracking and a Chinese V2EX forum thread used as the report's principal source; LDS did not find an independent audit of the market-size or traffic estimates. The forum itself includes self-reports from relay operators, so its claims should be treated as evidence about how participants describe the market, not as independently verified financial records.
Legitimate gateways, abusive supply
The report says many relays use one-api or its fork new-api to present an OpenAI-compatible endpoint backed by pooled credentials. Those projects are neutral gateway software and can support legitimate routing, quotas and billing. The abuse risk arises when operators stock the pools with stolen, leaked, shared or fraudulently funded accounts, or proxy traffic through an application that was never intended to provide public model access.
Vectoral documents tactics including automated free-trial farming, chargebacks, prepaid or stolen cards, exposed support chatbots and bursts designed to exhaust a victim's model budget. It also says buyers may use relays to bypass geographic restrictions, lower inference costs or obtain large volumes of output for model distillation.
What practitioners should take from it
For teams exposing model-backed applications, the investigation is a reminder that an unprotected endpoint can become inventory for a resale ecosystem. The useful response is layered cost and abuse control: low initial limits, hard spend caps, concurrency limits, anomaly alerts, payment-risk checks and account clustering.
None of those controls proves a request is legitimate, and aggressive blocking can harm real users. The practical goal is to bound losses, identify coordinated behavior and make abuse expensive enough that attackers move elsewhere. The report does not establish how common each fraud method is across the wider AI market, but it provides a concrete map of the incentives and infrastructure defenders need to consider.
Key Points
- 1Vectoral describes a four-layer relay economy spanning account suppliers, pooled credentials, customer-facing proxies and buyers of discounted inference.
- 2Its tracking found discounts as high as 97.8% from official list prices, but the market-size and traffic figures were not independently audited.
- 3Hard spend caps, concurrency controls and anomaly detection can limit losses even when account and payment checks miss abuse.
Scoring Rationale
The investigation gives AI application teams a concrete model of credential pooling and token-resale abuse, with direct implications for API exposure, spend controls and fraud detection. Its quantitative claims are researcher-reported rather than independently audited, which limits certainty but not the operational relevance.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
