Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- The reseller could use an intermediate proxy and modify the traffic like in [1], to get control of the client machine - depending on the harness permissions.
TLS terminates at the proxy (say, https://reselltokens.ai), end to end integrity is not enforced. LLM traffic contains tool calls like "bash ...", which are executed on the client machine, they can be manipulated. Secret exfil is also possible.
by veganmosfet - that one platform is using a flipped chroma logo - chroma has nothing to do with this racket (source : i’m chroma’s ceo)by jeffchuber
- Men breaching Sauron's ToS by reselling their nine rings of power, and they think they are beating the system.by TZubiri
- This research is way toooo shallow. He really should go check out linux.do or nodeseek.com — token resale economy there is truly breathtaking.
Edit: https://vectoral.com/blog/token-relay-market mentioned in comment.
by Sha1rholder - Wait a sec, I have to trust a third party with basically no reputation, did I get it right?
It's basically asking for being hacked and/or sending you private data to random email addresses! Neither at a 99% discount I'd do it.
I understand if someone, for any reason, cannot access a specific model ... But nowadays, there are so many alternatives that even this doesn't make sense any more.
by vb-8448 - Distillation is one of the most unique and interesting aspects of this.
But otherwise, if a company gives something valuable for creating an account on their platform, expect that people will automate the creation of millions of accounts. If employees of B2B partners get benefits, they will resell them. Accounts will be hacked and resold. The same basic abuse patterns are decades old for online delivery services, loyalty accounts for airline and hotels, etc. There are entire industries dedicated to those spaces as well: large organizations with physical offices, hundreds of employees, HR departments, etc. dedicated to reselling digital benefits on grey markets.
Some companies are tolerant of allowing this to happen. The pessimistic view is that even illegitimate traffic contributes to the KPIs that your investors care about. The slightly less pessimistic view is that fraud prevention will always have trade-offs and false positives, and sometimes the savings of preventing fraud are genuinely outweighed by the false positives. Or maybe it's just Hanlon's razor and they truly never saw it coming.
- The comments here are baffling. Is nobody seeing the easy opportunity for gathering amazing high-quality training data by inserting yourself as a MITM? If I were a competing lab, criminal, or opportunist I'd lie/cheat/steal/simply pay the difference to get the chance to listen into real life scenarios of usage of modern models in a high-impact business.
Seems a huge part of the story completely absent to me.
by loufe - The original article linked in the opening has more context https://vectoral.com/blog/token-relay-market
People trading their unused credits feels more genuine, although still in violation of the agreements. The person who got into YC Startup School who was trying to resell the $2500 of credits was interesting. It wouldn’t be that hard for OpenAI to identify the IP addresses of the relays and start flagging accounts, tracing it back to the source. Risking burning your bridges with YC for a relatively small profit is a questionable decision.
The original article showed discounts ranging all the way up to 98%. At those levels it’s obviously not people reselling anything. It’s either sourced from stolen API keys, bought with stolen credit cards, or acquired through automated sign up of trial accounts if you’re actually getting the API you request.
I would expect a lot of them are reselling a different API. Sign up for Anthropic tokens and get Deepseek responses instead.
by Aurornis