THE STACK · MODEL ECONOMICS · REFERENCE · Published July 3

The token-reselling grey market, July 2026: how API "transit stations" work, and the scams inside them.

Someone on your team finds Claude Opus or GPT-5.5 tokens for 90% off, through a reseller called a 中转站 — a "transit station." The software behind it is legal and open-source; the discount is not what it looks like. This is the anatomy of that grey market: the reverse-proxy plumbing, where the sub-cost pricing actually comes from, the best-documented scam (you are quietly served a cheaper model), the harder-to-prove ones, and the line between this and the legitimate ways to cut token cost. What is proven is labelled as proven; what is forum lore is labelled as lore.

45.83% audited shadow endpoints not serving the claimed model (CISPA)
24,000 fraudulent accounts Anthropic disclosed and shut down
428 stations in one security test; 9 shipped malicious code
TL;DR 30-second version · free
  1. 01 A transit station is a reverse proxy. You repoint base_url at the reseller's endpoint and use their key; they forward to the real OpenAI/Anthropic/Google API and hand the response back. The gateway software (one-api, ~35k GitHub stars; new-api) is neutral and legal, and its own docs demand lawfully-sourced upstream keys. The crime, when there is one, is in how the operator got the keys — not in the tool. So the category is genuinely mixed: some resellers are roughly legitimate bulk arbitrage, others are pure fraud, and the price alone does not always tell you which.
  2. 02 The best-proven harm is model substitution. A CISPA (Helmholtz) audit, "Real Money, Fake Models," evaluated shadow-API services and found 45.83% of the endpoints it tested were not serving the model they advertised, and a Gemini-2.5-flash relay's medical-QA accuracy fell from 83.82% on the official API to roughly 37%. That is the tell behind impossible pricing: a price hundreds of times below upstream cost is often being met by quietly downgrading the model. Separately, a security test of 428 stations reported (via Securities Times) 9 injecting malicious code, 17 attempting cloud-credential theft, and 1 stealing crypto — so the endpoint can be actively hostile, not merely cut-rate.
  3. 03 The rest of the risk is data, terms, and float. Your prompts and often your own upstream keys pass through an unaudited third party; buying resold access violates the real vendor's terms (Anthropic does not sell Claude commercially in mainland China, and disclosed ~24,000 fraudulent accounts behind 16M+ exchanges before rolling out biometric KYC); and a prepaid balance is at-risk float that vanishes if the station 跑路s (exit-scams) or the upstream sweeps its account pool — a Shanghai operator was criminally detained in May 2026. The legitimate ways to cut token cost — open weights, serverless open-model endpoints, official cloud resale — get you most of the savings with none of this.
DEEP ANALYSIS · free while in beta
READING AS
FOR YOU

If you are the one tempted by the discount, the whole decision reduces to one question: what is financing a price this far below upstream cost? If you cannot answer it, you are the answer.

The buyer's checklist

  • Price the tokens upstream first Compute what your volume costs the reseller at the official rate. A 30-40% discount can be real arbitrage; a price below the operator's own cost is financed by fraud or substitution.
  • Fingerprint the model First-token latency, token rate, knowledge cutoff, tokenizer quirks. A cheap client-side check catches "Opus" that is really Sonnet — 45.83% of audited endpoints were not the claimed model.
  • Never send an upstream key Bring-your-own-key relays put your real credential in an untrusted path; 17 of 428 tested stations attempted credential theft. If you must test one, use a throwaway key and rotate after.
  • Assume prompts are logged Send nothing confidential, no PII, no secrets. Treat every prompt as disclosed to an unaudited third party who may resell it.
FOR YOU

Frame this as an untrusted external code path with a financial motive, not a procurement discount. The response is the response you would give any untrusted intermediary handling secrets and returning executable content.

Controls that matter

  • Egress + policy block Prohibit resold access in policy and, where feasible, block known relay endpoints at egress. Pair the block with a sanctioned cheap alternative or it gets bypassed.
  • Key hygiene No production upstream key should ever transit a relay. If one has, rotate it. Scope keys narrowly so a leaked one is low-blast-radius.
  • Treat responses as untrusted input Relay output can carry injected code — 9 of 428 stations did exactly that. Validate and sandbox anything a relay response feeds into, especially tool-using agents and build steps.
  • Provenance monitoring Fingerprint checks and golden-set evals against production endpoints catch silent substitution. Make "which model answered" observable.
FOR YOU

The reason a team reaches for a 中转站 is almost always a budget nobody owns colliding with a cheap path that does not exist. Fix both, and the temptation goes away.

Remove the incentive

  • Give a sanctioned cheap path Serverless open-model endpoints, official cloud resale, and the configuration cost levers (caching, routing, batch) get most of the savings legitimately. Make them the default and document them.
  • Own the AI budget A named cost owner and a per-feature view mean nobody has to freelance a discount to stay under an invisible cap. Most grey-market use is a governance gap, not a rogue engineer.
  • Write the policy plainly Model access comes from approved sources; resold/relay access is prohibited. Short, explicit, with the approved list attached.
  • Diligence any reseller you do use If a genuine 官转-style discount is on the table, require KYC, a real entity, a data-processing agreement, and pricing that is a plausible discount off upstream cost.
FOR YOU

For a founder the exposure is not the token spend — it is provenance and reputation. If your product claims a model and a resold path silently serves a cheaper one, you inherit the accuracy failure and the customer trust hit.

Provenance is a product property

If you tell customers you run on a named frontier model, that claim has to survive an audit. A resold inference path where nearly half of audited endpoints served the wrong model turns your model claim into a liability — a support escalation at best, a compliance or false-advertising problem at worst. The savings never justify that.

The correct posture is boring: first-party or authorized access, an auditable data path, and the legitimate cost levers to keep margins healthy. It costs a little more per token than the grey market and vastly less than one incident in which it emerges that customer prompts were routed through an unaudited third party or answered by a model you did not claim.

The trade that is never worth it The legitimate stack already solves the problem the grey market pretends to: caching, routing, batch, and open-weight endpoints cut real spend by a large margin with full provenance. The 90%-off reseller is not a cost strategy — it is an unpriced risk you are carrying on behalf of whoever is financing the discount.

The anatomy of a transit station — the neutral parts and the fraudulent ones. Tags: legit (lawful on its own), grey (depends entirely on sourcing), fraud (the harm mechanism).

Proxy

Reverse-proxy endpoint

The core mechanism: you set base_url to the relay and use its key; it forwards to the official API and returns an OpenAI-compatible response. Legal on its own — this is how every legitimate gateway works too.

legit
Software

one-api / new-api gateway

The canonical open-source aggregation software (one-api ~35k stars, MIT; new-api, AGPL-3.0). Channel load-balancing, key redistribution, per-group rate multipliers, top-up codes. new-api's README explicitly requires lawfully-obtained upstream keys.

legit
Pool

Account pool (号池)

The operator bulk-registers or buys accounts (Claude Max, ChatGPT Plus, API keys), keeps them alive with scripts, and rotates them behind one endpoint. Neutral engineering; its legality depends on where the accounts came from.

grey
Channel

"Official" route (官转)

Enterprise bulk purchasing with unified billing and dynamic scheduling. Yields roughly 30-40% off, roughly legitimately. This is the defensible end of the market — real volume discounts passed through.

grey
Channel

"Reverse" route (逆向)

The near-zero-cost grey route: bulk free-tier and subscription accounts, reverse-engineered web protocols, account-pool rotation, sometimes stolen payment credentials. This is where the impossible 90%-off prices come from.

fraud
Arbitrage

Free-tier & plan arbitrage

The legitimate-looking cost source: aggregating free API credits, reselling unused quota, splitting flat-rate subscriptions (a $200/mo Max plan yields more tokens/$ than metered API). Abuse of the vendor's pricing, not always of the law.

grey
Swap

Model substitution (注水/偷换)

The best-proven fraud: advertise Opus/GPT-5, serve a cheaper or open model. CISPA found 45.83% of audited endpoints failed model-fingerprint checks. This is how sub-cost pricing is squared — you pay premium, you get economy.

fraud
Billing

Token-count inflation

The operator controls the billing backend, so reported consumption can be inflated over real usage (you see 1.5M tokens, 1M were used). Unauditable from the outside. Reported by Chinese financial press; hard to independently verify per-operator.

fraud
Harvest

Prompt & key logging

Everything you send — prompts, documents, and often your own upstream keys — passes through the operator in clear view. Log resale for training is reported; credential theft was observed in the 428-station test.

fraud
Float

Prepaid balance float

You pay up front into a balance. That float is the exit-scam (跑路) setup and the supply-risk: it evaporates if the station dies, gets shut down, or the upstream vendor sweeps its account pool. Never a small, recoverable amount by design.

fraud

A transit station is not exotic technology — it is the same reverse-proxy-plus-gateway pattern that runs legitimate multi-model platforms. That is exactly what makes the category confusing: the plumbing is neutral and open-source, so you cannot judge a reseller by its architecture. You judge it by where the tokens come from and what happens to your data. The sections below trace the mechanism, the real source of the discount, the fraud that squares the arithmetic, the vendor and legal response, and the line to the legitimate alternatives.

BEFORE
The "it's just a cheaper API" assumption
  • A discount is a discount — cheaper tokens, same model
  • The reseller has a volume deal I do not have access to
  • My prompts go to the model, like they would directly
  • If the model answers, it is the model I paid for
  • Worst case I lose a small prepaid balance
  • It is a billing choice, not a security or compliance one
→
AFTER
What is actually happening
  • A price hundreds of times below upstream cost is met by fraud or by a cheaper model — the arithmetic does not close otherwise
  • The cheap end is free-tier farming, subscription splitting, and reverse-engineered endpoints — not a volume deal
  • Prompts and your own keys transit an unaudited operator who may log and resell them
  • Nearly half of audited shadow endpoints were not serving the advertised model (CISPA) — provenance is not guaranteed
  • The prepaid balance is at-risk float; the account behind your access can be swept by the vendor overnight
  • It is a data-governance, ToS, and (in at least one jurisdiction) criminal matter, not just a line item

The right mental model is not "cheaper vendor" but "unaudited intermediary of unknown legality serving an unverified model." Some resellers are honest bulk arbitrage; the audit evidence says many are not, and you cannot tell from the outside. If the price is far below what the tokens cost the operator upstream, that gap is being paid by someone — assume it is by you, in accuracy, data, or account risk.

DEEP READ 6 sections · cited primary sources · technical review pending

01 The mechanism, and why the software is not the problem

Technically a transit station is a reverse proxy with a management layer. You change one setting — base_url — to point at the reseller's endpoint, use the key they issue you, and your existing OpenAI/Anthropic SDK code works unchanged because the relay returns an OpenAI-compatible response after forwarding your call upstream. This is the same shape as OpenRouter, Azure OpenAI, or any legitimate gateway; the pattern itself carries no signal about legality.

The management layer is usually one of two open-source projects, both real and both neutral. one-api (songquanpeng/one-api, ~35k GitHub stars, MIT-licensed) bills itself as an LLM API management and key-redistribution system: it does channel load-balancing, per-group rate multipliers (倍率), and USD-denominated quota tokens with redemption codes. new-api (QuantumNous/new-api, AGPL-3.0) is a rewrite that adds Stripe/EPay billing and cost accounting — and its README explicitly tells operators they must lawfully obtain upstream API keys and comply with the upstream terms of service. There is even a curated directory of these gateways on GitHub.

The point of establishing this first: you cannot condemn a reseller for running a proxy or for using one-api, any more than you can condemn a shop for using a cash register. The legality and the safety live one layer up, in how the operator sourced the accounts feeding the pool, and in what the operator does with your traffic. Everything downstream in this piece is about that layer.

  • one-api songquanpeng/one-api, ~35k stars, MIT. Key redistribution, channel balancing, rate multipliers, top-up codes. Neutral tooling.
  • new-api QuantumNous/new-api, AGPL-3.0. Adds billing + cost accounting. README requires lawfully-sourced upstream keys and ToS compliance.
  • The account pool Operators rotate many accounts behind one endpoint. Engineering is neutral; sourcing (free-tier farming, stolen cards, subscription splitting) is where the line is.
  • The tell is not the tech Reverse proxy + one-api is exactly what legitimate gateways run. Judge by key provenance, data handling, and price-vs-upstream-cost — not architecture.
PRIMARY SOURCE one-api (GitHub)

02 Where the discount actually comes from — the arithmetic that cannot close

Chinese technical writeups describe two channels. The "official" route (官转) is enterprise bulk buying with unified billing and dynamic scheduling; it yields something like 30-40% off and is roughly legitimate — real volume discounts, passed through. The "reverse" route (逆向) has a cost approaching zero: bulk-register free-tier accounts, reverse-engineer the web protocol, run a middle server, and rotate an account pool. Free-credit aggregation, reselling unused quota, and splitting flat-rate subscriptions (a $200/month Claude Max plan can yield more tokens per dollar than metered API) are the softer versions; stolen payment credentials are the harder one, though the AI-specific evidence for card fraud is weaker than the rest.

The reason the price is a diagnostic is arithmetic. One widely-circulated Chinese analysis put a promotional rate at roughly ¥1 for 2.85 million tokens. For a frontier model like Claude Opus, that token volume costs on the order of hundreds of yuan at the official rate — the analysis pegged it near 500 times below cost. A 30-40% discount can come from a real volume deal. A price 500x under upstream cost cannot come from efficiency; it has to come from either not paying for the tokens (fraud/theft on the sourcing side) or not delivering the tokens you paid for (model substitution on the serving side). Both happen.

This is the single most useful heuristic in the whole market: compute what the tokens would cost the reseller upstream at the official rate, and compare. A modest discount is plausibly legitimate arbitrage. A discount that implies the operator is selling below their own cost is telling you that the gap is being financed by something you would not agree to if it were disclosed.

CAVEAT The ¥1 = 2.85M-token figure and the ~500x-below-cost framing come from Chinese market analysis (Securities Times and community writeups), not from a vendor. The direction is robust — below-upstream-cost pricing is not sustainable cleanly — but treat the exact multiple as illustrative, not precise.
PRIMARY SOURCE Securities Times — transit-station market analysis

03 Model substitution — the best-documented fraud

The strongest evidence in this entire market is academic. Researchers at the CISPA Helmholtz Center for Information Security published "Real Money, Fake Models: Deceptive Model Claims in Shadow APIs" (arXiv 2603.01919). They audited shadow-API services with a model-fingerprinting method — comparing behavioural signatures, output distributions, and cosine distances against the genuine models. Of the endpoints they evaluated, 45.83% failed fingerprint verification: they were not serving the model they claimed. A further group showed suspicious deviations short of an outright fail.

The consequence is not abstract. On the same audit, a Gemini-2.5-flash endpoint's accuracy on MedQA (medical question answering) collapsed from 83.82% on the official API to roughly 37% through a shadow relay — the kind of degradation that is invisible in casual use and catastrophic in a high-stakes application. An independent practitioner has since documented a lightweight version of the same detection: an endpoint claiming Claude Opus that answered with a 0.7-second first token (Opus is slower), ~85 tokens/second (Sonnet-like), and a 2024 knowledge cutoff instead of Opus's later one — a cheaper model wearing the expensive model's label.

Model substitution is what makes the impossible pricing possible. If you advertise Opus and serve a small open model, your cost is a fraction of what you charge and the arithmetic closes — at the buyer's expense. For anyone building a product on a specific claimed model, this reframes the risk: "which model actually answered" stops being a given the moment access is resold, and it needs to be verified rather than assumed.

  • 45.83% of audited shadow endpoints failed model-fingerprint verification — not the claimed model (CISPA).
  • 83.82% -> ~37% Gemini-2.5-flash MedQA accuracy, official API vs a shadow relay. Invisible in casual use, dangerous in medicine/law.
  • Fingerprinting Latency, token rate, knowledge cutoff, and tokenizer artifacts expose substitution. A cheap client-side check catches "Opus" that is actually Sonnet.
PRIMARY SOURCE CISPA — Real Money, Fake Models (arXiv)

04 Active malice, data harvest, and the distillation connection

Beyond serving the wrong model, some endpoints are actively hostile. Security researchers who tested 428 stations (a mix of paid and free) reported — via Securities Times — 9 that injected malicious code into responses, 17 that attempted to steal AWS/cloud credentials, and 1 that directly targeted Ethereum assets. That reframes a transit station from "cheaper API" to "untrusted code path with a financial motive," because a response you feed into a tool-using agent or a build pipeline is an execution vector.

The quieter harm is data. Everything you send transits the operator: prompts, uploaded documents, and frequently your own upstream API keys if you are using a bring-your-own-key relay. Reporting describes proxies harvesting requests and selling the logs for training, and a named industry expert (a former Xiaomi OS AI specialist) called transit data "essentially exposed... a complete black box." For any regulated or confidential workload, that alone is disqualifying regardless of the pricing.

It is tempting to connect this directly to the industrial-scale distillation story, but the honest version is careful. Anthropic's February 2026 report disclosed roughly 24,000 fraudulent accounts generating more than 16 million Claude exchanges, attributed to DeepSeek, Moonshot, and MiniMax, all in violation of terms and regional access — and Anthropic attributes those accounts to the labs directly. The inference that transit stations were the bridge feeding those accounts is plausible and widely asserted, but it is inference, not something the report establishes. We flag the distillation crackdown as the vendor-side context, not as proof of a specific transit-station-to-lab pipeline.

CAVEAT The 428-station figures (9 malicious / 17 credential-theft / 1 crypto) are from a named security test reported by Securities Times — strong secondary, not a peer-reviewed dataset. The "transit stations fed the 24k distillation accounts" causal link is not established by Anthropic's report; do not treat it as proven.
PRIMARY SOURCE Anthropic — detecting and preventing distillation attacks

05 Enforcement, legality, and why the account can vanish

This is not purely a caveat-emptor grey zone; it has started to draw hard enforcement. In May 2026 in Shanghai, a transit-station operator was criminally detained for 37 days and then released on bail (取保候审) for illegally obtaining and reselling overseas LLM API access via reverse-proxy and account-pool — the likely charge being 非法经营罪 (illegal business operation), with possible unlicensed value-added telecom exposure on top. The operator publicly stated he expected sentencing, disgorgement, and a fine. Chinese state media reported in June 2026 that the sector faces a rectification "storm," and legal analysis flags PIPL and Data Security Law exposure for the data-handling side.

On the vendor side, the terms are unambiguous and the account risk is concrete. Anthropic does not sell Claude commercially in mainland China, so access resold into that market violates its terms by construction — which means the account underpinning your cheap access is itself a policy violation that can be terminated. After the distillation disclosures Anthropic deployed identity verification including live biometric checks; reporting notes those are being circumvented via ID-verification services in low-income countries, but the direction of travel is clear: the accounts feeding these pools are getting harder to create and easier to sweep.

The practical implication for a buyer is supply risk you do not control. The documented exit-scam anecdotes — a developer paying about ¥45/month for "unlimited" access that died within a month with the support group vanishing; another whose ¥25/month station died in roughly 20 days during an OpenAI account-suspension sweep — are individual, unbranded cases, so do not read them as a specific operator's crime. Read them as the structural failure mode: your prepaid balance and your continuity depend on accounts and legality entirely outside your control.

CAVEAT The Shanghai case operator is not publicly named and had not been sentenced as of research; it is one strong-secondary case, not a body of case law. The exit-scam examples are individual named-developer anecdotes, not proof against any specific reseller brand.
PRIMARY SOURCE Tencent News — Shanghai transit-station case

06 The legitimate alternatives — getting the savings without the exposure

The reason the grey market is a bad trade is that the legitimate ways to cut token cost now get you most of the savings with none of the risk. Open-weight models you self-host or buy from a serverless endpoint run $0.05-$2 per million tokens with full provenance and no third party in your data path. Official first-party and cloud resale — Azure OpenAI, Google Vertex, AWS Bedrock — give you real discounts, real SLAs, and an auditable data-handling posture. OpenRouter is an authorized multi-model marketplace (note that its free tier is a thing grey stations farm, which is abuse of OpenRouter, not OpenRouter being illicit).

The distinguishing markers of the grey-vs-legitimate line are consistent: authorized key and account sourcing versus reverse-engineered endpoints and farmed accounts; KYC and a real business entity versus anonymous top-ups; an auditable data-processing agreement versus a black box; and, above all, pricing that is a plausible discount off upstream cost versus pricing that is below the operator's own cost. If a reseller clears those, it is likely in the defensible 官转 end of the market. If it cannot, the discount is being financed by something you have not been told about.

For the cost levers themselves — caching, routing, batch, agent-loop control — the sanctioned playbook does the heavy lifting: most teams can cut real spend by a large margin through configuration alone, long before anyone is tempted by a reseller. The grey market solves a problem that the legitimate stack has already largely solved.

  • Open weights Self-host or serverless open-model endpoints ($0.05-$2/Mtok). Full provenance, no third party in the data path. The Chinese open-weight cluster (GLM, Kimi, MiniMax, DeepSeek) makes this stronger every quarter.
  • Official cloud resale Azure OpenAI, Vertex, Bedrock — real discounts, real SLAs, auditable data handling. The boring, correct answer for regulated workloads.
  • Authorized marketplace OpenRouter and similar — legitimate multi-model routing. Its free tier being farmed by grey stations is abuse of it, not a mark against it.
  • The config levers Caching, routing, batch, agent-loop control cut real spend by configuration alone — see the team-level cost playbook. Solve the cost problem here, not in the grey market.
PRIMARY SOURCE Saving LLM costs — team playbook

The scam taxonomy, ordered by how well-documented each pattern is, not by how often it is alleged. Severity reflects the damage when it happens; confidence is stated in each entry.

  1. 01 HIGH

    Model substitution — advertised model, cheaper model served

    The best-documented fraud (VERIFIED-PRIMARY). CISPA audited shadow-API services and found 45.83% of evaluated endpoints failed model-fingerprint verification; a Gemini-2.5-flash relay's MedQA accuracy collapsed 83.82% -> ~37%. This is how sub-cost pricing is squared: you pay for Opus, you get an open model, and in casual use you never notice.

    DO Fingerprint the model you actually receive: check first-token latency, token rate, knowledge cutoff, and tokenizer artifacts against the genuine model. For anything built on a specific claimed model, verify provenance rather than assuming it — and never route high-stakes (medical, legal, financial) inference through resold access.
  2. 02 HIGH

    Malicious responses & credential theft

    Some endpoints are actively hostile (strong SECONDARY). A security test of 428 stations reported 9 injecting malicious code, 17 attempting cloud-credential theft, and 1 stealing crypto. A relay response fed into a tool-using agent or build pipeline is an execution vector, not just text.

    DO Never send a bring-your-own upstream key through an untrusted relay, and never feed relay output straight into an agent with tool access or a build step without validation. If you have used one, rotate every credential that touched it and scan anything that consumed its responses.
  3. 03 HIGH

    Prompt & data harvesting

    Everything you send transits the operator in the clear: prompts, documents, and often your own keys. Log resale for training is reported, and a named industry expert called transit data "essentially exposed... a complete black box." For confidential or regulated data this is disqualifying on its own, regardless of price.

    DO Treat any prompt ever sent through a grey relay as disclosed to a third party. Prohibit resold access for any workload touching customer data, PII, secrets, or IP, and prefer paths with an auditable data-processing agreement (official cloud resale, self-hosted open weights).
  4. 04 HIGH

    ToS violation & account termination

    Buying resold access violates the real vendor's terms by construction — Anthropic does not sell Claude commercially in mainland China, and disclosed ~24,000 fraudulent accounts (16M+ exchanges) before deploying biometric KYC. The account behind your cheap access is itself a violation that can be swept, cutting you off without warning or refund.

    DO Assume any access resold across a region the vendor does not serve is on borrowed time. Do not build a production dependency on it; if continuity matters, you need a first-party or authorized relationship, not a pool account that can vanish in the next enforcement sweep.
  5. 05 MEDIUM

    Exit scams (跑路) & prepaid-float loss

    A prepaid balance is at-risk float by design. Documented anecdotes describe stations dying within weeks with support groups vanishing, and stations collapsing during upstream account-suspension sweeps. These are unbranded individual cases — the structural risk, not a specific operator's proven crime.

    DO If you use any reseller at all, never prepay more than you can afford to lose, keep balances minimal, and keep a sanctioned fallback wired so a station disappearing is an annoyance, not an outage. Company-operated and KYC'd resellers are lower-risk than anonymous top-up ones — but none are zero.
  6. 06 MEDIUM

    Token-count inflation

    The operator controls the billing backend, so reported token consumption can be inflated over real usage. Reported by Chinese financial press; unauditable from the outside and hard to verify per-operator, so treat it as a plausible pattern rather than a proven universal.

    DO Meter independently: log your own request/response token counts client-side and reconcile against what the reseller bills. A persistent gap is a red flag. This is another reason provenance and auditability beat a headline discount.
  7. 07 MEDIUM

    Silent accuracy collapse in high-stakes use

    The downstream effect of substitution and degradation: a model that looks fine on easy prompts can be far below the genuine model on hard, domain-specific ones (MedQA 83.82% -> ~37%). The danger is that it is invisible until a wrong answer in medicine, law, or finance carries real cost.

    DO Keep a golden-set eval on your actual hard cases and run it against whatever endpoint you use; a resold endpoint that scores well below the official API on your own set is disqualified. For regulated decisions, do not resell the inference path at all.

Concrete moves for a team that wants the savings without the exposure. All three are cheap and most orgs have done none of them.

  1. 1

    Put "resold model access" on the prohibited list — and give a sanctioned cheap path

    Write it into policy that model access must come from first-party, official cloud resale, an authorized marketplace, or self-hosted open weights — not a discount reseller. Pair the prohibition with a real answer: a serverless open-model endpoint or the configuration cost levers (caching, routing, batch) so nobody is tempted by a 中转站 to hit a budget. A ban without an alternative just drives it underground.

  2. 2

    If anyone has used one, treat it as an incident

    Rotate every credential — especially any upstream API key — that was ever sent through a relay, treat all prompts sent through it as disclosed to a third party, and scan anything that consumed relay responses for injected content. Then find out why someone reached for it: a budget nobody owned, or a legitimate cheap path that did not exist.

  3. 3

    Verify model provenance for anything you build on a claimed model

    Add a lightweight fingerprint check — first-token latency, token rate, knowledge cutoff — to confirm you are receiving the model you are paying for, and keep a golden-set eval on your hard cases running against your production endpoint. "Which model actually answered" is a diligence item now, not an assumption, wherever there is any intermediary between you and the vendor.

Forces that will reshape this market over the next few quarters — each can move the grey-vs-legit calculus materially.

Vendor KYC and biometric verification hardening

Anthropic's identity-verification and live-biometric checks are the leading edge of a broader move to make the accounts that feed these pools harder to create and easier to revoke. As KYC tightens across vendors, the reverse-channel supply gets more expensive and less reliable — which both shrinks the grey market and pushes its remaining operators toward more aggressive fraud to hold margins.

Criminal enforcement setting precedent

The May-2026 Shanghai detention and the June-2026 rectification "storm" are the first hard enforcement signals. Whether this produces sentencing and a body of case law, or fizzles, will determine if operating a reverse-channel station stays a low-consequence side hustle or becomes a genuine criminal risk. Watch for a first published conviction.

The legitimate price floor closing the gap

Open-weight models on serverless endpoints ($0.05-$2/Mtok) and falling flagship prices (Sonnet 5's introductory $2/$10) keep shrinking the arbitrage the grey market feeds on. The more the sanctioned cheap path approaches the grey price, the less rational the risk becomes — the grey market is partly a symptom of a pricing gap that the legitimate stack is steadily closing.