A Black Market in Stolen LLM Tokens Is Thriving, and API Security Hasn't Caught Up

A Black Market in Stolen LLM Tokens Is Thriving, and API Security Hasn't Caught Up

Open-source proxy tools called one-api and new-api have become the plumbing for an underground economy where resellers pool stolen and abused API credentials to sell discounted access to large language models, according to an investigation by Matt Lenhard that developer and writer Simon Willison surfaced on July 26 1. The market operates predominantly out of China, and its mechanics expose a gap in how LLM vendors manage their own keys 1.

This is not a story about sophisticated exploitation. The supply chain for pooled credentials runs through ordinary negligence: free trials with no spending caps, customer-support chatbots left exposed to the public internet, and in some cases stolen credit cards or chargeback attacks 1. The proxy software is itself legitimate. Both one-api, created by developer songquanpeng, and new-api, maintained under the organization QuantumNous, are API management tools designed to load-balance requests across multiple model providers 23. Each repository includes disclaimers about lawful use. But the same load-balancing architecture that helps an enterprise route traffic across a dozen vendor credentials also helps a reseller pool hundreds of stolen ones. The tool does not distinguish between the two.

How the relay market works

A reseller deploys one-api or new-api, loads the proxy with credentials harvested from trials, exposed endpoints, and payment fraud, then sells discounted API access through the proxy to buyers 1. Those buyers include individual developers seeking cheaper tokens or a route around geo-restrictions on LLM access. Willison noted that the principal source for Lenhard's investigation was a Chinese-language forum thread 1.

Willison observed that the marketplace has made him more cautious about publicly exposing any LLM-driven application. "There's now an entire ecosystem that can profit from finding a new unprotected endpoint to exploit" 1.

The pricing failure underneath

The relay market is a direct consequence of how LLM vendors have structured their trial programs and key management. Generous free tiers attract developers, but without per-key dollar caps those same tiers become supply lines for credential pooling. Willison called for vendors to offer hard spending caps that cut off an API key the moment it reaches a defined threshold 1.

The technology for per-key caps exists at every major API gateway. What is missing is default enforcement at the vendor level. A support bot with no rate limit and a publicly reachable endpoint is not a vulnerability in any traditional security sense. It is a pricing decision that happens to be exploitable.

What teams should do now

For any team shipping an LLM-powered product with an API surface, the relay market changes the cost-benefit calculus of basic key hygiene. Per-key spending caps that cut off spend at a threshold you define per billing period are now essential. Network access to any internal-facing LLM endpoint, including support bots, needs to be restricted to authenticated users. And sudden traffic spikes should be treated as potential credential abuse rather than organic adoption.

None of these are new ideas in API security. What is new is a profit-driven ecosystem specifically incentivized to find every endpoint where they are not implemented.

The investor signal

A gray market in LLM compute at this scale tells you something structural about the industry. Commodity markets spawn arbitrage economies when a resource becomes cheap, standardized, and widely traded enough that reselling at a margin covers the operational overhead. LLM API access has crossed that threshold. The relay market is not a fringe phenomenon; it is a lagging indicator of commodity maturity.

Vendors whose business models depend on trial generosity or loose endpoint controls are the ones absorbing the cost of every resold token. The price of an unprotected API key is no longer theoretical. It shows up as compute consumption on someone else's invoice.