31–40 of 141 posts
It's basically asking for being hacked and/or sending you private data to random email addresses! Neither at a 99% discount I'd do it.
I understand if someone, for any reason, cannot access a specific model ... But nowadays, there are so many alternatives that even this doesn't make sense any more.
The reseller could use an intermediate proxy and modify the traffic like in [1], to get control of the client machine - depending on the harness permissions. TLS terminates at the proxy (say, https://reselltokens.ai ), end to end integrity is not enforced. LLM traffic contains tool calls like "bash ...", which are executed on the client machine, they can be manipulated. Secret exfil is also possible. [1] https://arxi…
There are community plugins like this: https://github.com/rheodev/cpa-plugin-privacyfilter
I haven't tried the plugin system myself yet.
Cyberpunk dystopia vibes
right. Abstractions taken to the max. When tech solves problems that only 0.001% care about. NFT smelt similar.
Wait a sec, I have to trust a third party with basically no reputation, did I get it right? It's basically asking for being hacked and/or sending you private data to random email addresses! Neither at a 99% discount I'd do it. I understand if someone, for any reason, cannot access a specific model ... But nowadays, there are so many alternatives that even this doesn't make sense any more.
If your startup needs to run a million records of something, especially public data, through an LLM to extract the data you need, using bootleg tokens to shrink the bill starts feeling tempting.
If you're concerned about the data leaking, the biggest risk is that the API backends are quietly routing your requests to a cheaper model. You might be trying to buy Opus tokens but get Deepseek Flash responses.
This research is way toooo shallow. He really should go check out linux.do or nodeseek.com — token resale economy there is truly breathtaking. Edit: https://vectoral.com/blog/token-relay-market mentioned in comment.
> CREDITS FROM YC STARTUP SCHOOL Join YC, get free shit from the network, profit. Nice.
What does the demand side look like? I understand why people have these tokens they want to sell, who wants to buy them?
Especially for Claude because Anthropic is very good at identifying mainland Chinese and getting them banned in hours. There are many of them who are willing to pay more than the original rate for a stable experience.
It's very hard for them because they'll need a legit phone number and bank cards that are not issued in China, and a clean enough IP, etc. and those better match together to make sense. (Back in the day, ChatGPT required resident IPs, which made it worse, but they worry about growth more now). Obviously, they have to use a VPN to access the real Internet, and most of the IPs they can find are shared with bots and abusers.
Wait a sec, I have to trust a third party with basically no reputation, did I get it right? It's basically asking for being hacked and/or sending you private data to random email addresses! Neither at a 99% discount I'd do it. I understand if someone, for any reason, cannot access a specific model ... But nowadays, there are so many alternatives that even this doesn't make sense any more.
I expect most of the use to be for bulk data processing or desperate founders who don't care, not for agentic coding use at promising startups. If your startup needs to run a million records of something, especially public data, through an LLM to extract the data you need, using bootleg tokens to shrink the bill starts feeling tempting. If you're concerned about the data leaking, the biggest risk is that the API back…
Maybe this make sense, but anyway I have to pay a lot of attention at the output I get. Eg: who guarantees there is no prompt/sql injection? Especially if I have to load the output in some internal system.
It is...incredible how many there are. Stripe does far too little in my opinion to help prevent issues like this, even though they have the business intelligence and enough data to do so.
The original article linked in the opening has more context https://vectoral.com/blog/token-relay-market People trading their unused credits feels more genuine, although still in violation of the agreements. The person who got into YC Startup School who was trying to resell the $2500 of credits was interesting. It wouldn’t be that hard for OpenAI to identify the IP addresses of the relays and start flagging accounts,…
But also, resellers only need to make an overall profit including kickbacks from the companies purchasing token history for distillation.