Tools 2026-08-17

One reseller was selling frontier model access at a tenth of list price. Its own leaky server showed it had 872 active customers — and it read every prompt.

Okta's threat intelligence team published an investigation on 4 August into more than half a dozen underground services selling discounted or 'unlimited' access to frontier models. One, calling itself Poison Claude, charged 5–15% of official per-token rates for Opus 4.8, 4.7 and 4.6 and Sonnet 4.6, and paid for it by pooling accounts that exploit the $100 credit AWS Bedrock gives new signups. A misconfiguration on its own API exposed its customer count: 881 registered users, 872 of them active. A second service, Ecomagent, offered Opus and GPT Codex 5.5 below market and appears to work off Google Cloud startup credits, which run up to $350,000. Payment is in cryptocurrency. Okta also counted more than 105,000 brute-force signup attempts from 251 IP addresses against a single AI video service between June 2023 and July 2026, with ready-made trial accounts selling for about $40 in Tether. A separate investigation by Vectoral on 10 August found a parallel, less criminal version of the same trade: brokers buying unused API credits from startups and reselling them at 30–80% off, one offering $100,000 a day of spending power. Both note the same structural fact — these services do not hand over a key, they proxy your request, which means the operator sees the full text of everything you send.

Why it mattersThe discount is real and so is the cost, but the cost is not billed to you in money. Anything you put through one of these proxies — support tickets, customer records, unreleased plans, internal code, contracts — passes in readable form through a business that is already committing fraud against a cloud provider and takes payment in crypto to stay unidentifiable. That is a worse counterparty than almost any vendor a company would sign a contract with. It is worth knowing this exists because the offers circulate where developers already are, on GitHub, Telegram and marketplace listings, and a 90% discount is precisely the kind of thing a team under budget pressure forwards to a colleague without asking where the margin comes from.

✓ Verified · 3 sources

Read in the app — free, in 9 languages

Apple Music will tell you when a song was made by a machine — but the uploader decides whether to say so
2026-08-21 Stripe has just paid $7.5 billion for a model router. Days later Ramp built one and is giving it away until January.
2026-08-21 Meta's assistant is now a Mac app that reads your screen and types into any window — and what it sees can train the model
2026-08-21 One click on a news site now tells Google to show you more of it — and you stay on the page you were reading
2026-08-21 Adobe will now generate the music, the voiceover and the door slam — and it says the licence covers you
2026-08-21

One reseller was selling frontier model access at a tenth of list price. Its own leaky server showed it had 872 active customers — and it read every prompt.

Related stories