Kcalbin LLC

Is Your AI Traffic Going Through a Reseller?

Somebody can move your entire AI workload onto a stranger's servers by editing one line of config. Nothing breaks. Nothing alerts. The bill just gets smaller.

17 August 2026 · Kcalbin LLC · Registry version 2026-08-17.1. Screening signal, not legal advice.

The cheap-tokens market is not a rumour and it is not small. Grey-market Claude access has been documented selling at 70–93% below official pricing — in one case roughly thirteen cents of usage per dollar spent. Founders are openly quoted 40–50% off list. At that spread, somebody on your team will eventually be tempted, and they will not think of it as a security decision.

Here is the part that makes it one. The brokers do not hand over provider API keys. They route your requests through their own endpoint. One broker was reported handling $100,000 of daily spend that way. Whoever terminates the request sees everything inside it.

What is actually in those requests

Not just the question you typed. A modern agent request carries the system prompt, the tool definitions, the tool call arguments and results, the reasoning trace, and whatever source code was pulled into context to answer the question. That is a remarkably complete picture of how your product works.

And capturing it is not a hypothetical risk — it is a documented revenue stream. Reporting on this market describes operators logging and reselling user activity: prompts, outputs, tool calls and reasoning traces, sold on as training data. The customer is paying twice, once in cash and once in proprietary material, and only one of those charges appears on an invoice.

The supporting infrastructure is industrialised rather than improvised: account farms, phone-verification services for passing signup checks, identity brokers producing credentials, routers, payment processors. This is a supply chain, not a few people with spare quota. Okta's threat-intelligence team has separately documented fake-signup operations feeding free-tier credits into that supply.

Why it does not show up anywhere

Redirecting an SDK is a single environment variable. OPENAI_BASE_URL is all it takes, and every mainstream client honours it, because pointing at a self-hosted gateway is a legitimate and common thing to do.

So there is no failed build, no exception, no new dependency in the lockfile for a scanner to notice. Responses come back correctly formatted, because they came from the real model — by way of somebody else. Your spend drops, which reads as a win. Nothing in a normal review pipeline is looking at the one field that changed.

What we check, and how

We scan your repositories, environment files and CI configuration for every LLM endpoint they point at, and report the ones that are not your provider.

The important design decision is that we do not rely on a blocklist of known bad domains. A blocklist can never be complete — relay endpoints appear constantly and private relay stations run on throwaway domains, so anything built that way is out of date the day it ships.

Instead we work from the other direction. We hold the documented official endpoints for the major providers — 14 exact hosts and 5 cloud-suffix rules covering the OpenAI, Anthropic, Google, Azure, Bedrock, Mistral, Cohere, Groq, DeepSeek, xAI, Perplexity, Together and Fireworks APIs — and report anything that is not one of them. An endpoint nobody has ever catalogued is still reported, because it is not official. That is exactly what a brand-new relay looks like.

Our registry then adds attribution on top: 19 catalogued relay and gateway endpoints across 8 channel classes, each entry carrying the public source it came from — principally the public awesome-ai-api-proxy inventory of relay stations, which is also where the channel taxonomy below comes from. The classes are what drive severity, and they are not all equally bad:

  • Reverse-engineered web access — critical. Not a reseller at all; it drives a consumer session on your behalf, with no provider relationship anywhere in the path.
  • Mixed-channel relay — critical. Blends genuine official keys with other channels, so you cannot tell which of your requests were served legitimately.
  • Commercial relay forwarding official keys — high. May well forward real keys, but the operator still terminates your request and can log it.
  • Named commercial aggregator — medium, deliberately. Using one is often a considered architectural choice. We tell you it is there; whether it was intended is your call.
  • Self-hosted gateway on a private address — low. No third party in the path at all, assuming the host is yours.

How we know it works

Two things were tested before this went on sale.

It catches what it should. Against a repository with deliberately planted endpoints, it flagged all of them — including one on a domain that appears nowhere in our registry, caught purely because it was not an official provider endpoint. That case is the whole argument for the allowlist design, so it is the one we test.

It stays quiet when it should. Run across 976 files of real production code, it produced zero findings. Getting there took real work: an early build flagged eleven, because baseUrl is a variable name used for every API on earth, and it was cheerfully reporting the US Census API and a list of vendor blog URLs. A detector that cries wolf is worse than no detector, so generic keys now require genuine LLM context before they count.

What this does not do

Three honest limits, because a security tool that oversells itself is a liability:

  • It reads configuration and source, not live network traffic. A relay injected at runtime by a secret manager, or set in an environment variable that never touches a file, will not appear in a file scan.
  • The registry is real but not exhaustive. We can name the relays that public inventories have documented. Unnamed hosts are still reported — as unknown, for you to verify — but we cannot tell you who runs them.
  • A finding is not an accusation. Plenty of teams route through an aggregator on purpose. The scan tells you where your traffic goes, not whether someone did something wrong.

Pricing

$390 for a one-time scan: we run it across your codebase and configuration and send back severity-ranked findings with file, line number and the offending line, plus a JSON report for your own tooling.

$1,490/year for continuous monitoring: run the scanner yourself as often as you like, with registry updates as new relay endpoints surface. It exits non-zero on findings, so it drops straight into CI.

The registry is the part that decays, which is why monitoring is the subscription and the one-off scan is not.

Buy a scan — $390   See what the scan covers

Sources

Every factual claim above traces to a public source. The registry carries the citation for each catalogued endpoint; these are the load-bearing ones for the market claims.