One reseller was selling frontier model access at a tenth of list price. Its own leaky server showed it had 872 active customers — and it read every prompt.

Okta's threat intelligence team published an investigation on 4 August into more than half a dozen underground services selling discounted or 'unlimited' access to frontier models. One, calling itself Poison Claude, charged 5–15% of official per-token rates for Opus 4.8, 4.7 and 4.6 and Sonnet 4.6, and paid for it by pooling accounts that exploit the $100 credit AWS Bedrock gives new signups. A misconfiguration on its own API exposed its customer count: 881 registered users, 872 of them active. A second service, Ecomagent, offered Opus and GPT Codex 5.5 below market and appears to work off Google Cloud startup credits, which run up to $350,000. Payment is in cryptocurrency. Okta also counted more than 105,000 brute-force signup attempts from 251 IP addresses against a single AI video service between June 2023 and July 2026, with ready-made trial accounts selling for about $40 in Tether. A separate investigation by Vectoral on 10 August found a parallel, less criminal version of the same trade: brokers buying unused API credits from startups and reselling them at 30–80% off, one offering $100,000 a day of spending power. Both note the same structural fact — these services do not hand over a key, they proxy your request, which means the operator sees the full text of everything you send.

✓ Verified · 3 sources

Related stories