A 10% discount on AI inference can come from a volume contract. At 30%, thin margins, routing across models or cheap promotional credit might still explain the price. When an intermediary can sustainably offer premium models for a tiny fraction of official rates, another question belongs beside the benchmark: who absorbs the difference?
Matt Lenhard's investigation of the token-relay market describes services that proxy requests to major model providers and resell access at prices sometimes far below list rates.1 Hackaday resurfaced the subject on August 25, 2026 with a useful distinction: relaying traffic is not inherently fraudulent; the problem begins when the inference inventory was obtained without paying its normal cost.3
That nuance matters. An API proxy can legitimately handle load balancing, observability or consolidated billing. The economic problem sits upstream of the proxy.
The missing cost
Every request eventually lands on a bill: model provider, cloud account, promotional credit, software subscription or a third-party product paying inference for its own users.
If the buyer pays almost nothing while the reseller still makes money, the margin has to come from somewhere: a genuinely low acquisition cost, a deliberate subsidy, or a bill shifted onto someone who never chose it.
Lenhard documents several sources in the last category: abused promotional credit, bills that will not be honored, fraudulent payment instruments, compromised accounts or keys, and AI features in third-party products repurposed as general inference capacity.1 Methods vary. The accounting does not.
A neutral relay
Avoid the shortcut: pooling multiple API credentials says nothing by itself about where they came from.
A company can have several projects, providers or authorized accounts and use a gateway to distribute requests. Platforms openly sell multi-model routing. An intermediary might also legally purchase unused credits from another company when the relevant contracts permit transfer.
Vectoral describes a parallel market of “token brokers” offering to buy and resell unused startup credits.2 Again, an asset changing hands proves little by itself. Terms of service, provenance and transfer rights matter.
Concern rises when price no longer resembles official cost, supply keeps changing source or the service cannot plainly explain what it is reselling.
An extreme discount proves nothing by itself. It simply gives the buyer a reason to ask harder questions before integrating the service.
Invisible inventory
From the buyer's perspective, a relay removes most provenance. The developer receives a compatible endpoint, a reseller-issued credential and a model list. Behind that interface the service can change accounts or upstream providers without changing the client's integration.1
That abstraction makes a relay convenient and its risk hard to read at the same time.
Two identical SDK calls can hide completely different economic histories. One is billed to an authorized business account. The other consumes a resource whose owner does not know it is being used.
Opacity eventually becomes a continuity problem too. Fraudulent supply tends to disappear: a payment instrument gets blocked, a key revoked, credit exhausted or an exposed endpoint fixed. A relay can suddenly lose capacity or reroute traffic.
A customer who selected the service only on price discovers that the discount also contained supply risk.
Your feature is inventory
For makers and small teams, the clearest lesson may sit somewhere other than the buyer's side. It concerns applications that pay for their own tokens.
Lenhard describes abuse directed at AI features embedded in products: if a backend accepts overly broad user requests and forwards them to a model paid for by the publisher, that feature can become inference supply for somebody else.1
The upstream key can stay perfectly hidden while the bill still leaks sideways. A credential can remain safely on the server while the product endpoint around it is still economically exploitable because its use is not sufficiently bounded.
This is where conventional key-security guidance remains necessary but incomplete. Anthropic recommends keeping keys private, avoiding repositories and separating keys by use case.4 Google recommends restrictions, isolation, rotation and usage monitoring.5
Those measures protect the credential. They do not automatically bound the budget behind it.
Bound the product
A feature called “summarize this support ticket” has no reason to quietly accept arbitrary content, context sizes and request rates as though it were selling a general API.
Technical capacity should match the product being sold: authentication, per-user or per-organization quotas, input-size limits, allowed models, periodic budgets, anomaly monitoring and a quick way to disable a suspicious route.
The target is not invulnerability. It is to bound diverted usage until it stops working as cheap, scalable token inventory.
Economic abuse often needs no spectacular vulnerability. A small repeatable asymmetry at large scale can be enough.
Buying uncertainty
For the buyer, the calculation flips almost like a mirror. An extremely cheap relay can look ideal for prototypes or token-hungry agents. Price is only one part of the cost.
Price also carries stability, prompt confidentiality, visibility into subcontractors, contract terms, usable invoicing and the risk of an upstream policy change cutting access.
If a service cannot answer “where does this capacity come from?” in plain language, the developer is buying that uncertainty too.
That does not make every intermediary suspect by default. A router or reseller can provide genuine value through volume negotiation, API unification, caching, observability and failover. But that value should exist without requiring an upstream cost that is mysteriously close to zero.
Discount as evidence
The market is gradually turning the token into something close to a commodity: bought, pooled, routed and resold. Once an asset becomes liquid enough, grey markets form around price gaps and imperfect controls.2
The useful question is no longer “is this relay cheap?” but what economic architecture makes this price possible?
A volume contract can explain it. A cheaper model behind a compatible layer can explain it. A temporary marketing subsidy can explain it.
And sometimes the cost never disappeared at all. It simply landed on somebody else's account.