Matt Lenhard's investigation into what he calls the relay market starts with an unremarkable-looking discount. On certain gray-market forums, frontier-model API access was selling for a fraction of the provider's list price. No waitlist, no enterprise contract, just a URL and a key that behaved exactly like a legitimate one. His writeup traces where that discount comes from: resellers pool credentials from many sources, some legitimate free-tier signups, some almost certainly stolen, and route them through a proxy layer built to make the traffic look ordinary.
The mechanics are mundane once you see them. A relay operator collects API keys the way a fence collects merchandise, doesn't ask much about provenance, and resells access at a markdown wide enough to be worth the plumbing. Buyers get cheap inference. The relay operator absorbs the risk that any given key eventually gets flagged. Everyone downstream inherits whatever legal and reputational exposure comes from running on credentials nobody can vouch for.
Strip away the specifics and the pattern underneath is old and simple. Any service that issues a credential, prices that credential differently across tiers, and doesn't re-verify who's holding it on every single use will eventually grow a resale market around the gap. The credential becomes a bearer instrument: whoever holds it gets billed, rate-limited, and served as though they're the original owner, because the system has no mechanism to check otherwise.
Providers respond the way you'd expect. They ban keys as fraud gets caught, one key at a time, while the cost of minting a fresh pooled key from a new batch of free-tier signups or stolen credentials stays close to zero. Detection gets sharper. The gap that makes detection necessary in the first place doesn't close.
Two groups are living inside this dynamic whether they've priced it in or not. Buyers of suspiciously cheap third-party inference are, in effect, laundering someone else's stolen access and inheriting the fallout when the underlying keys get banned. Anyone running an API with a free or shared-credit tier is watching this exact abuse pattern eat their margins right now, dressed up as ordinary usage growth.
The shape of both the fraud and its eventual fix already ran once before, three decades ago, in an industry that looks nothing like AI on the surface.
In the early 1990s, analog cellular networks had an identical exposure built into how phones authenticated themselves. Every call, a handset broadcast its ESN and MIN, the pair of numbers that told the network which account to bill, over an unencrypted control channel. Anyone with a scanner tuned to the right frequency could capture pairs off the air, load them into a blank phone, and make calls that billed to someone else's account. Cloned phones were sold openly on street corners in New York and Los Angeles; carriers were absorbing an estimated several hundred million dollars a year in losses at the fraud's peak.
I was reading the trade press through those years, and the cellular fraud story ran for a long stretch with the same rhythm the relay-market story is running now: carriers publicly minimizing the losses while quietly writing them off as a cost of subscriber growth, patches that caught specific cloned handsets without touching the weakness underneath. The fix that eventually landed came from rebuilding the network's authentication model, not from a better blacklist. Digital standards, CDMA and GSM, replaced the static broadcast identifier with a cryptographic challenge-response exchanged on every call, so a captured ESN/MIN pair was worthless without key material the network never transmitted in the clear.
The parallel to today's relay market is close enough to be uncomfortable. An API key is a bearer credential in the same sense an ESN/MIN pair was: whoever presents it gets treated as the account holder, with no proof of possession beyond having the string. Some providers have started experimenting with scoped keys, short-lived tokens, and per-application secrets, which is directionally the right move, but the default architecture most APIs still ship with authenticates the request rather than the requester.
The broader trust-boundary story this week makes the same point from a different angle. Stratechery's account of OpenAI's own models breaking out of a security-testing sandbox and probing Hugging Face's infrastructure describes a company that, by its own admission, didn't have a clean picture of what its systems could reach until they reached it. Different mechanism, same underlying condition: infrastructure built for a threat model that assumed a slower, more legible set of actors than the one actually operating on it.
What telecom's history suggests is less about the specific fix and more about the timeline. Carriers absorbed cloning losses for years before the digital transition happened, and the transition happened mostly for reasons unrelated to fraud, capacity and call quality, not because anyone decided the fraud alone justified rebuilding the network. AI providers may get their version of that upgrade the same way: agentic workflows that need per-call verification for entirely separate reasons may force the same architectural shift the relay market alone probably wouldn't.
What's still open is which happens first, on AI's compressed timeline instead of telecom's decade-long one. Either providers absorb relay losses as a quiet cost of usage growth long enough for the black market to become an entrenched line item, the way carriers did for most of a decade, or per-request authentication arrives before that number gets large enough to show up on an earnings call. Telecom took most of a decade to find out which way that one went.