The Shadow Relay Market: LLM API Reselling and Fraud Risk

Key Takeaways

An investigation published by researcher Matt Lenhard on the Vectoral blog, and amplified to a wide security audience by Simon Willison on July 26, 2026, documents a mature underground economy that pools stolen and abused large language model API credentials and resells access to them at steep discounts [1][2]. The ecosystem runs on two open-source, OpenAI-compatible gateway projects, one-api and new-api, which were built as legitimate self-hosted proxies for developers managing multiple model providers but have been repurposed by resellers into commercial “transfer stations” serving customers largely in China [1][3][4]. Pricing data gathered from these relays shows discounts as steep as 97.8 percent off official rates, with one operator observed offering the equivalent of $3,333 in official Anthropic API credit for roughly 425 RMB (approximately $59), and the ten highest-traffic relays tracked in the investigation drawing a combined 3.6 million monthly visits [1]. The underlying credentials feeding this market are obtained through free-trial abuse, stolen or prepaid payment cards, chargeback fraud, and exploitation of unprotected support chatbots that expose live model access, meaning that much of the discount a buyer receives is very likely underwritten by a provider, a startup, or a cardholder absorbing costs they never agreed to [1]. Two distinct harms flow from this activity: financial fraud against API providers and payment networks, and data exposure risk for any organization whose traffic transits relay infrastructure it does not control, including buyers seeking cheap tokens for commercial model distillation and developers who unknowingly route sensitive prompts through unaudited middlemen [1][2]. Security teams should treat this relay market as a downstream symptom of the same credential-theft economy CSA has tracked under the LLMjacking label, and should apply the same discipline (spend caps, anomaly detection, credential rotation, and endpoint authentication) to both attack surfaces [5].

Background

The relay market did not emerge in isolation; it is the commercial layer built on top of a credential-theft economy that has been industrializing since 2024. Sysdig’s Threat Research Team first documented LLMjacking, the unauthorized use of stolen credentials to access hosted AI inference, in May 2024, and industry reporting citing Sysdig telemetry noted a 376 percent increase in credential theft aimed specifically at AI services between the fourth quarter of 2025 and the first quarter of 2026 [6]. CSA’s own June 2026 research documented how that stolen access has since been organized into a formal supply chain, citing “Operation Bizarre Bazaar,” which catalogued roughly 35,000 attack sessions between December 2025 and January 2026 tied to an underground marketplace selling access to more than 30 LLM providers [5]. The relay market Lenhard documented is best understood as the retail face of this same supply chain: card merchants and account merchants supply the raw material (stolen payment instruments and bulk provider accounts), account-pooling operators aggregate that access behind a single API using tools like one-api and new-api, and downstream relay operators wrap the pooled access in consumer-facing, Chinese-language storefronts with their own billing and support [1].

One notable feature of this market, relative to earlier LLMjacking reporting, is the scale of legitimate-looking commercial infrastructure that has grown up around it. Lenhard found price-comparison aggregators, such as getcheapai.com, that let buyers shop between competing relays the way a consumer might compare cloud hosting prices, and directory sites, such as hvoy.ai, that run promotional giveaways to attract new relay customers [1]. A March–June 2026 discussion thread on the Chinese forum V2EX, viewed roughly 35,000 times and drawing 190 replies, described the market in explicitly commercial terms, with one participant characterizing the practice of using resold Claude and Codex access to train competing domestic models as “a multi-billion RMB industry chain” and others describing daily token allocations in the tens of terabytes [1]. The Hacker News discussion that followed Willison’s post debated whether this activity constitutes fraud in a strict legal sense or a more ambiguous breach of provider terms of service, but from a defensive standpoint, the more actionable fact pattern is that large volumes of LLM API traffic are being routed through infrastructure whose operators have no contractual relationship with, and no accountability to, the model provider whose brand and capacity they are reselling [2].

Security Analysis

How the Relay Ecosystem Obtains and Launders Access

Individually, the abuse techniques underpinning the relay market are well-documented fraud patterns rather than novel exploits; the operational sophistication, as fraud-detection practitioners who track this market later describe it, lies not in any single technique but in orchestrating them at the scale needed to sustain a multimillion-visit-per-month marketplace. Free-trial abuse involves automating account creation to repeatedly claim introductory credits, which are then pooled and resold before the provider can act on the anomalous signup pattern [1]. Chargeback and stolen-card schemes fund initial account creation with payment instruments the reseller never intends to honor, extracting usable API access in the window before the provider or card network detects the fraud [1]. A third technique, which Lenhard calls “denial of wallet,” involves flooding a victim’s exposed endpoint, often an unprotected support chatbot wired directly to a model API, with concurrent requests purely to burn through the victim’s budget or rate limit, sometimes without any resale motive at all [1]. Each of these methods produces the same output: a pool of working API keys or session tokens that a midstream operator can load-balance across using one-api or new-api, both of which were designed as legitimate self-hosted gateways for consolidating multiple provider accounts behind a single OpenAI-compatible interface [1][3][4]. One-api appeared roughly four times as often as new-api across the relays Lenhard tracked, suggesting it remains the dominant tooling choice in this specific market segment, though both are actively maintained open-source projects with substantial legitimate developer followings that have no control over how their software is deployed downstream [1].

The Data Exposure Dimension

Fraud against API providers is the more visible harm, but the data exposure risk to end users and enterprises is arguably more consequential for CSA’s audience. Because relay operators’ business model depends on evading detection by the providers they resell, there is likely little to no meaningful assurance about logging, retention, or onward use of traffic that passes through their infrastructure. Lenhard’s investigation notes that a substantial share of relay demand comes from buyers seeking cheap access specifically to harvest model outputs for commercial distillation, training competing models on Claude- and Codex-generated responses, which means proprietary prompts, code, and business context routed through these relays may be captured and repurposed well beyond the original user’s intent [1]. This risk compounds for organizations that unknowingly rely on relay-fronted access because a vendor, contractor, or shadow-IT tool embedded a reseller endpoint instead of an official provider endpoint to cut costs; the enterprise in that scenario typically has little to no visibility into where its data actually travels and little to no contractual recourse if it is mishandled. The same dynamic applies in reverse: developers who plug a discounted relay key into an internal tool for cost savings are effectively granting an unvetted third party a persistent window into whatever queries that tool sends, a shadow-IT pattern that mirrors the credential sprawl CSA has documented in AI-assisted software development, where AI-service credentials embedded in code and configuration increased 81 percent year-over-year in public repositories during 2025 [7].

Infrastructure Vulnerabilities Feed the Same Market

The relay market’s raw material is not limited to fraud against payment systems; unpatched infrastructure vulnerabilities feed it directly. CVE-2026-7482, nicknamed “Bleeding Llama,” is a critical unauthenticated memory-disclosure flaw in Ollama’s GGUF model loader, patched in version 0.17.1, that allows an attacker to issue three unauthenticated API calls to a self-hosted Ollama instance and exfiltrate heap memory that can contain API keys, environment variables, system prompts, and other users’ conversation data; researchers estimated roughly 300,000 internet-facing Ollama servers were at risk before patching became widespread [8]. Separately, the March 2026 supply chain compromise of the Trivy vulnerability scanner cascaded into LiteLLM, a widely used open-source AI gateway, resulting in malicious package versions that harvested AI provider credentials from at least 1,000 enterprise SaaS environments before the compromise was contained (CVE-2026-33634, CVSS 9.4) [9]. A third pattern operates through the software supply chain rather than server infrastructure: CSA has separately documented a campaign distributing 15 malicious JetBrains Marketplace plugins, installed roughly 70,000 times, that exfiltrated AI provider API keys to an external command-and-control server [11]. Neither Lenhard’s investigation nor these disclosures document a confirmed handoff between these specific incidents and the relay market described above, but structurally, credentials harvested from unauthenticated inference servers, compromised package registries, or malicious IDE plugins have no natural boundary preventing them from entering reseller pipelines like the ones Lenhard tracked [1][8][9][11]. On the Hacker News discussion of the relay market, a WorkOS engineer described building dedicated fraud-detection tooling for this exact problem, characterizing the adversaries as “surprisingly sophisticated” and the underlying economics as a genuinely lucrative market rather than a marginal abuse pattern [2].

Recommendations

Immediate Actions

API providers and any organization operating a customer-facing LLM gateway should enforce hard per-account spend caps and concurrency limits from the moment of account creation, since nearly every abuse technique documented in this market, from free-trial farming to denial-of-wallet flooding, depends on an account being able to generate unbounded usage before detection catches up [1]. Organizations running self-hosted inference servers such as Ollama should confirm they are patched to version 0.17.1 or later and should verify these endpoints are not bound to 0.0.0.0 or otherwise reachable from the open internet, since CVE-2026-7482 requires no authentication to exploit [8]. Any organization that has deployed LiteLLM should confirm its installed version postdates the March 2026 supply chain incident and should rotate any credentials that were active on affected systems during the compromise window, since upgrading alone does not undo exposure that already occurred [9].

Short-Term Mitigations

Security and procurement teams should audit third-party tools, contractors, and internal shadow-IT deployments for API keys pointed at unfamiliar or reseller-branded endpoints rather than official provider domains, since a discounted or unusually cheap LLM API integration is itself a signal worth investigating. Teams operating public-facing chatbots or support tools that call an LLM API directly should confirm those endpoints require authentication and rate-limit unauthenticated traffic, closing off the “open inference” abuse path relay operators actively scan for [1]. Behavioral monitoring should extend to registration-to-first-token timing, model-selection patterns, and IP reputation signals such as proxy or VPN use, all of which the fraud-detection community has found useful for distinguishing legitimate new accounts from relay-harvested ones [1][2].

Strategic Considerations

Enterprises should recognize that the relay market and LLMjacking-driven credential theft are two faces of one problem: a credential-theft economy that treats AI API access as a fungible, resellable commodity. Applying Zero Trust principles to AI infrastructure, treating API keys as privileged credentials with short lifetimes and least-privilege scoping, and extending secret-scanning programs to cover AI-service credential formats are likely to reduce exposure to both the fraud losses documented here and the broader offensive uses of stolen AI compute CSA has tracked separately [5]. Organizations evaluating third-party AI tools or vendors as part of procurement should treat unusually deep pricing discounts on LLM-dependent features as a due-diligence flag warranting a direct question about which upstream provider account is actually being billed.

CSA Resource Alignment

This relay market is best understood as the commercial retail layer sitting on top of the credential-theft supply chain CSA documented in “LLMjacking Evolves: Stolen AI Compute as Attack Infrastructure,” which traced the same underlying economy from opportunistic cost-shifting to an industrialized market including Operation Bizarre Bazaar’s 35,000-session marketplace for stolen access to more than 30 LLM providers [5]. That note’s recommendations on credential rotation, billing-anomaly alerting, and treating AI API keys as privileged assets apply directly to the relay activity documented here; organizations that have already implemented those controls in response to CSA’s LLMjacking guidance are likely well-positioned to limit their exposure to relay-driven fraud and account abuse.

CSA’s “Vibe Coding Security Crisis: Credential Sprawl and SDLC Debt” research note is directly relevant to the data exposure dimension of this market, since it documents the mechanisms by which AI-service credentials end up embedded in code and configuration where they can be harvested or misused, finding that AI-assisted commits expose secrets at more than twice the rate of human-authored commits and that AI-service credential exposure in public repositories rose 81 percent year-over-year during 2025 [7]. The same credential-hygiene failures that note documents make it easier for a developer or shadow-IT tool to route traffic through a reseller endpoint without realizing it, and the note’s SDLC-governance recommendations are a relevant complement to the relay-specific mitigations above.

Finally, the AI Controls Matrix (AICM v1.1), as the superset of the Cloud Controls Matrix, provides the relevant control baseline for organizations formalizing defenses against this market, particularly its identity-and-access-management and threat-and-vulnerability-management domains, which cover credential lifecycle management, least-privilege API scoping, and monitoring for anomalous access patterns [10]. Organizations building a business case for AI credential governance investment can use AICM’s control objectives to structure both the immediate technical mitigations and the longer-term procurement and vendor-assessment practices this analysis recommends.

References

[1] Lenhard, Matt. “An Inside Look at the Relay Market Powering Token Resellers and Fraud.” Vectoral, June 28, 2026.

[2] Hacker News. “The relay market powering token resellers and fraud.” Hacker News, July 2026.

[3] songquanpeng. “one-api: LLM API management & key redistribution system.” GitHub, 2026.

[4] QuantumNous. “new-api: A unified AI model hub for aggregation & distribution.” GitHub, 2026.

[5] Cloud Security Alliance. “LLMjacking Evolves: Stolen AI Compute as Attack Infrastructure.” CSA AI Safety Initiative, June 18, 2026.

[6] hard2bit. “LLMjacking: stolen AI compute and the bill you pay.” hard2bit, 2026.

[7] Cloud Security Alliance. “Vibe Coding Security Crisis: Credential Sprawl and SDLC Debt.” CSA AI Safety Initiative, March 31, 2026.

[8] Security Boulevard. “Bleeding Llama (CVE-2026-7482): Critical Unauthenticated Memory Leak in Ollama.” Security Boulevard, May 2026.

[9] Averlon. “CVE-2026-33634: Responding to the Trivy and LiteLLM Supply Chain Attacks.” Averlon, March 2026.

[10] Cloud Security Alliance. “AI Controls Matrix (AICM) v1.1.” Cloud Security Alliance, June 22, 2026.

[11] Cloud Security Alliance. “AI Toolchain Hijacked: IDE Plugin API Key Theft.” CSA AI Safety Initiative, June 2026.