The Black Market for Intelligence

During the three months that ended in June, Microsoft reported $41 billion in capital expenditures, roughly two-thirds of it on short-lived assets, primarily CPUs and GPUs. In the same earnings call, Satya Nadella said the company had brought another gigawatt of capacity online. Microsoft did not say that every dollar or the entire gigawatt belonged exclusively to generative AI. Even with that limit, a gigawatt is the sort of measurement normally reserved for cities and power stations. Microsoft was using it to describe how fast it was expanding the machinery that supplies computation.

At the other end of the artificial-intelligence economy, a coding company called OpenCode was selling a subscription for $10 a month. OpenCode Go promised access to a collection of AI models, and the company said its ambition was to give the ordinary subscriber roughly six times the subscription price in model usage. Pay ten dollars, potentially consume something like sixty.

There was nothing irrational about that. OpenCode could negotiate bulk discounts and reserve GPU capacity. Customers would use different amounts; some would exhaust their allowances and many would not. But the distance between those two numbers, the billions required to build the machinery and the ten dollars required to start using it, is where this story begins.

For several years the AI industry has been performing an act of compression. Enormous spending on chips, data centers, electricity and networking has been folded into a text box. The customer does not see a power plant or a rack of accelerators. The customer sees a blinking cursor.

The economics were compressed the same way. Expensive computation was wrapped in free trials, promotional credits, monthly subscriptions and easily copied API keys, and the companies doing it had good reasons. They were acquiring users in a brutally competitive market. They needed developers to experiment, companies to build products on their platforms, and people to form habits before some other AI company got there first. So the industry made access easy.

Ease of access turned out to have a second constituency.

A conventional software subscription is a permission slip. A subscription to an AI service is also a claim on machinery: every request can consume GPUs, electricity and model capacity. The claim may be small, but it has a measurable cost and it can be exercised immediately.

That makes an AI account a strange asset. It is not money, and it cannot be deposited in a bank. It is not quite a product either. It is closer to an entitlement to future work by a machine, and entitlements can be stolen. They can be manufactured in bulk, bought with someone else’s credit card, aggregated, routed through intermediaries, resold, and exercised around the clock by software that never sleeps.

AI companies and payment processors now describe a sharp increase in what is usually called token fraud. The term is useful mainly because it is short. As an explanation it obscures almost everything that matters.

Tokens are units used to meter AI models. They are not dollars and they are not transferable bearer instruments; a criminal cannot ordinarily withdraw a million Claude tokens and deposit them at OpenAI. What moves through the underground economy is access: subscriptions, promotional credits, accounts, API keys and proxy services. The distinction sounds like pedantry until the numbers get enormous, at which point it becomes the whole story.

For most of the software era, the free trial was one of the simplest bargains in business. Try the product, perhaps you will like it, perhaps you will eventually pay. The marginal cost of one more person wandering around inside a conventional piece of software was usually negligible. The customer might never come back, but the trial had done its job if enough other people converted.

AI changed the cost structure without at first changing the ritual. The free trial stayed. So did the free credits and the frictionless signup. Behind them was computation with a real meter running.

In March, Stripe published an unusual statistic: its systems had detected 6.2 times more abusive free trials in February 2026 than three months earlier, and AI companies were driving much of the increase. Across four fast-growing AI businesses, Stripe said, it had blocked more than 550,000 trials judged to be at high risk of abuse over a two-month period, and estimated that those interventions prevented $4.4 million in downstream compute losses.

The figure should be handled with care. Stripe sells fraud prevention, and its estimate depends on assumptions about what those accounts would have consumed had they not been stopped; the company has not published enough underlying data for anyone to reconstruct the counterfactual. The phenomenon behind it, though, was easy to understand. Somebody had worked out that a free AI trial was not merely a chance to inspect software. It was free compute.

Inside Cursor, the popular AI coding company, that distinction became painfully concrete. Jacob Witt arrived for what was supposed to be a two-day interview process and walked instead, by his account, into what he later called a literal fraud war room.

The problem was a good idea gone sour. Cursor had offered a generous free trial with no payment card required, an excellent way to persuade programmers to try an unfamiliar product, and it was becoming expensive. Witt later said the inference cost generated by trial users was approaching, and in some cases exceeding, the cost generated by certain groups of paying users. His interview assignment abruptly became the problem the company was trying to solve: how do you put a credit card in front of a free trial without wrecking the conversion funnel?

A compact history of the AI business hides inside that question. The industry wanted frictionless adoption because its products were strange, new and changing quickly. A developer who would never authorize a purchase order for an unproven AI tool might happily click Start free trial, and growth depended on removing reasons to hesitate. Fraudsters benefited from precisely the same design, because the legitimate user and the abusive user wanted the same thing: less friction. Cursor experimented with requiring cards, then killed the generous trial altogether and replaced it with a much smaller free experience.

That is the economic bargain underneath much of the AI boom. Companies spent enormous sums making intelligence expensive to produce and cheap to sample, and then discovered that the sample could be industrialized.

Subscription businesses have always depended, to some degree, on human limitation. People buy unlimited phone plans and do not talk for thirty days straight. They buy gym memberships and skip Tuesday. They subscribe to streaming services and eventually go to bed. Usage varies, the light customer subsidizes the heavy one, and the average matters more than the theoretical maximum.

Artificial intelligence introduces a customer with no reason to behave that way. A machine does not go to bed, get bored or need lunch. It can consume an allowance continuously, and when one account reaches its limit it moves to another.

OpenCode Go shows the tension with unusual clarity. The subscription costs $10 a month, and OpenCode says it aims to provide around six times that in model usage, using bulk discounts and reserved capacity to make the economics work. For an ordinary developer that is an attractive subscription. For a reseller it raises a different question: how quickly can the sixty dollars be extracted from the ten-dollar account?

Imagine buying a buffet ticket from a restaurant that assumes customers will eat one dinner, then discovering that the ticket can be attached to a machine that eats twenty-four hours a day and parcels the food into takeout containers for hundreds of other people. The problem is not merely heavy usage. It is that the subscription has become wholesale inventory.

An automated operator can run many accounts at once, place their entitlements in a common pool, and put a gateway in front of the pool that routes customer requests to whichever accounts still work. If one is disabled, another takes over. At that point the difference between retail and wholesale starts to matter. The AI provider believes it is selling an individual subscription; the operator believes it is buying compute below market price. The same object is being valued under two different assumptions about who, or what, will consume it.

This kind of arbitrage predates AI. Telephone systems have suffered toll fraud for decades. Cloud providers have spent years fighting “freejacking,” in which attackers create armies of accounts to harvest promotional compute. In 2023, security researchers at Palo Alto Networks documented a campaign that used more than 130,000 fake cloud accounts to obtain resources for cryptocurrency mining. AI did not invent the theft of digital resources. It made them unusually easy to recombine.

The industry also spent years standardizing the way software talks to models. That interoperability was enormously useful: a developer could swap one provider for another without rebuilding an entire application. It also had a shadow. If many accounts can speak through roughly compatible interfaces, many accounts can disappear behind a single one.

The customer sees one API. Behind it might sit a legitimate commercial agreement, a promotional credit, fifty subscriptions, a stolen cloud credential, or hundreds of accounts bought with compromised cards. Once the request emerges from the other end as a plausible model response, provenance becomes difficult to see. The AI companies had made intelligence interchangeable enough to create a market. Someone else noticed that the market did not have to be theirs.

It is tempting to picture “AI token fraud” as a single criminal enterprise, a thief stealing some new form of digital currency. The reality is messier and considerably more interesting, because several different businesses live under the same phrase.

Some attackers do not care about AI at all. They have a list of stolen credit-card numbers and need to know which ones still work; an AI company has an automated checkout, so they push transactions through it and the company becomes, in effect, a card-validation service. Others want the AI itself, and buy subscriptions with compromised payment credentials, consume the compute and leave the company holding the chargeback later. Others create large numbers of accounts and claim promotional credits over and over, or simply exhaust flat-rate subscriptions. Others harvest an API credential accidentally published in software code and send the resulting model bill to its rightful owner. Others run a relay for customers who cannot obtain official model access where they live, or advertise a premium model while quietly routing requests to a cheaper one. Still others use fraudulently obtained access not to sell chatbot responses at all, but to generate examples for training a competing model.

Calling all of that token theft is like calling every crime involving a bank “money fraud.” True, perhaps, and useless. The distinctions matter because the victim changes with the scheme. In card testing, the immediate victims may be cardholders and issuers, while the AI company is being used as infrastructure. In stolen-card resale, the cardholder and the AI company can both lose. In API-key theft, the AI provider may get paid exactly what it is owed, and the victim is the person whose cloud account receives the bill. A relay operating across a regional restriction may be violating a contract without stealing anything, while a relay substituting a cheaper model is cheating its own customer.

The underground economy makes more sense as a supply chain than as a single fraud. Acquire access. Determine which access works. Pool it, hide the pool behind a gateway, sell the output, and replace whatever gets shut down.

It is commodity trading in perishable goods. Accounts spoil, credentials get revoked, promotions expire, providers change their identity requirements, cards are charged back and rate limits tighten. Inventory has to be replenished constantly. And the whole enterprise turns on one peculiar characteristic of AI: the product can be consumed before the financial system finishes deciding whether it was legitimately purchased.

On August 25, Dax Raad, the creator of OpenCode, posted an image from Stripe. The dashboard showed $323,033,617.04 blocked. It was such an absurd figure that it seemed to describe an entirely new order of criminal enterprise, and OpenCode was not a company that could plausibly shrug off hundreds of millions of dollars in theft. The screenshot quickly became part of a wave of claims that something enormous was happening around AI tokens.

Another coding company, Cline, posted an even more astonishing crop: more than $8.3 billion blocked. OpenRouter’s cofounder said the company was blocking ten times more payments than it had a month earlier. Neither supplied the denominators needed to turn those figures into a loss estimate. The numbers had everything a technology panic requires, novelty and crime and artificial intelligence and billions of dollars, and they were also extraordinarily easy to misunderstand.

After Raad posted the screenshot, someone asked whether the surge was model distillation, the extraction of model outputs at scale. No, Raad explained: this particular batch appeared to be criminals effectively “distilling credit cards,” testing stolen numbers to find out which ones still worked. The $323 million suddenly meant something completely different.

Card testing is an old payment crime. A fraudster obtains card details, then automatically submits transactions to find valid credentials, and a successful card can later be used elsewhere or resold. The merchant being bombarded with attempts may be almost incidental. A Stripe dashboard can therefore show a terrifying amount of blocked payment volume without implying that anybody tried to consume an equivalent amount of AI.

The difference is not academic. Blocked payment volume is not stolen money, not necessarily authorized money, not AI credits acquired, not inference consumed and not the merchant’s loss. It is the face value of activity that a payment-control system rejected.

Even apparently simple financial numbers become slippery during a fraud event. Retries can matter. Different dashboard views can count or deduplicate activity differently. The number of dollars submitted tells you nothing directly about the number of attackers, payment instruments or successful transactions. The Cline figure is more extreme and even less interpretable; the public crop did not provide the basic denominators anyone would need to know what it represented.

The AI industry possesses tremendous amounts of data about its own fraud problem, and yet much of what the public sees consists of spectacular screenshots whose numbers originate at completely different layers of the transaction. An attempted dollar, a blocked dollar, an authorized fraudulent dollar, a dollar charged back, a dollar of compute delivered, a dollar the company actually lost and a dollar the reseller earned are seven different things. They cannot be casually added together, and one cannot be substituted for another because the result makes a better headline.

There is no reliable public estimate of the worldwide dollar value of AI-access fraud. That uncertainty is not a failure of the story; it is one of its central facts. The systems that measure money and the systems that measure intelligence are looking at the same event from different directions. The billions tell you there is an attack surface. To understand the business, you have to follow the smaller numbers.

A month before the $323 million screenshot, OpenCode had disclosed another incident. The number was far less spectacular and far more useful. A single operator, the company said, had controlled roughly 8,000 fraudulent OpenCode Go accounts and was reselling an estimated $480,000 worth of model usage each month. Here, finally, was the shape of the black market.

Raad later described the loop in broad terms. Compromised cards were used to fund accounts. The accounts produced API access. The keys were pooled, a gateway sat in front of the pool, and customers bought discounted model usage through the gateway. Eventually the fraudulent payments were reversed. The compute had already happened.

That sequence is the important part. In traditional retail fraud, a criminal might buy a television with a stolen card, and the store loses a physical object that can subsequently be resold. Here the object disappears at the moment it is manufactured. A model request arrives, GPUs perform work, an answer is returned. There is nothing for the merchant to repossess when the chargeback arrives.

OpenCode’s $480,000 figure is an estimate, not an audited loss statement. Publicly available information does not establish the reseller’s actual revenue, the company’s compute cost or the total chargebacks associated with the operation. The number is valuable less because it measures the fraud perfectly than because the mechanism behind it makes sense. A ten-dollar entitlement can contain more than ten dollars of consumable usage. Fraudulent payment can drive the acquisition cost lower still. Automation maximizes consumption, compatibility hides many accounts behind one endpoint, and customers can be charged less than official rates and still leave a margin. By the time the financial system sends the bad news backward, the intelligence has already traveled forward.

OpenCode removed 7,013 accounts in another enforcement action in August and estimated $400,000 in monthly savings. It did not establish publicly whether those accounts overlapped with the earlier operation, which is another reason not to add the two announcements into a grand fraud total.

What happened inside the company after these incidents may be more consequential than the totals. Raad described building an AI-assisted investigative system that correlates information across the company’s application database, Stripe and Honeycomb, an observability service used to understand what software is doing. A founder who had set out to build an AI coding product was now connecting payment records to infrastructure telemetry, looking for common identities hidden behind superficially different accounts. The fraudsters had turned software access into a financial product; the software company responded by becoming a financial-intelligence operation.

Cursor arrived at the same place by another route. The war room Witt walked into on his interview day was merely the beginning. The company kept tightening controls until, by his account, it had accumulated more than 200 fraud rules in Stripe Radar. Then users found another loophole.

Cursor had a customer-friendly principle: if an AI request ended in an error, the user should not have to pay for it. That was easy enough to honor when a request lasted seconds and cost very little. AI coding agents changed the scale, since a long-running agent could work for minutes, generating valuable code as it went. Witt said users discovered that they could cancel at a point that left them with useful generated output while causing the transaction to be treated as an error and therefore not charged.

What made the logic clever was that it exploited the product’s conception of fairness rather than the payment system. No completed request, no charge. Customers simply arranged for the request to become incomplete once they had received what they wanted. Cursor closed the loophole, and the complaints started.

Witt said the public reaction was fierce enough that the company nearly reversed its decision. Only after examining usage patterns did Cursor conclude that some of what looked like organic customer outrage was coordinated abuse involving bots. That remains Cursor’s assessment, and the company has not made the underlying evidence public.

The symmetry of the episode is hard to miss. The company had automated coding and the attackers automated consumption; the company automated fraud detection and the attackers, Cursor believed, automated protest. A rule intended to distinguish success from failure had become an extraction surface, and a forum intended to register customer dissatisfaction had become another place where identity itself could be manufactured. Every generous feature now has to answer the same question: what happens if the person using it is not a person?

The underground economy becomes easier to see from China, where intermediaries are commonly described as 中转站, or transfer stations. The term sounds illicit in English, but the underlying service does not have to be.

Suppose you are a developer who wants to use an American AI model. The provider does not officially operate in your country, or it will not accept your local payment method, or you want several different models without maintaining accounts with several foreign companies. A transfer station solves those problems. You pay the intermediary, the intermediary gives you an API, your software sends requests to it, and somewhere upstream the relay finds a model capable of answering. You may never know how. That last part contains both the legitimate business and the black market.

A relay can be a convenience layer, regional arbitrage or an ordinary reseller. It can also be a pool of promotional accounts, funded by stolen cards, stocked with compromised credentials, or serving a different model from the one the customer believes they are buying. From the customer’s side of the interface, all of those possibilities look identical.

Chinese-language reporting has provided rare interviews with people operating inside this market. One pseudonymous operator, “Mo,” described what happened after Anthropic tightened its identity requirements. At first she thought the consequences would be manageable. Within a day, she said, the economics of her account pool were changing: accounts were becoming more expensive, supply was becoming less stable, and keeping the service running meant finding replacement inventory.

The language of the business is revealing. A legitimate subscriber thinks about an account as an identity. A transfer-station operator thinks about it as supply. Mo described customers in China, Europe, Latin America, South Asia and Iran, some of whom simply wanted access to models that were expensive or difficult to buy through official channels.

This is what makes the transfer-station economy morally untidy. There are real customers solving real problems. A programmer in a restricted country is not automatically a criminal for wanting to use Claude, and a small business is not stealing merely because it wants to pay in a currency the model provider does not accept. But an opaque intermediary that solves those problems can simultaneously obscure where its inventory comes from. Clean and dirty access are functionally compatible, and once they enter the same pool they can become indistinguishable.

Another pseudonymous operator, “Sukie,” claimed to have tried to run a relatively clean version of the business, using accounts registered with real identities and genuine payment information. Under those conditions, she said, the math was unforgiving: a relay buying legitimate access, maintaining infrastructure, replacing accounts and supporting customers might need to charge something like 70 or 80 percent of the official provider’s price.

That made another class of offer difficult to explain. Some transfer stations advertised AI usage for a tenth of official prices. Perhaps the operator had access to extraordinary discounts, or was burning promotional credits, or another business was subsidizing the loss. Perhaps customers would eventually discover that the expensive model they had supposedly purchased was something else entirely. Or perhaps the accounts were acquired dishonestly. Price, in this market, is evidence rather than proof.

Sukie described medium-size pools containing hundreds or thousands of accounts. Some lasted for months; others disappeared almost immediately. Someone had to monitor bans, replenish supply, resolve customer complaints, handle payments and deal with the relay’s own abusers, because an operator trying to exploit an arbitrage could itself be exploited.

This is a recurring feature of gray markets. Once normal contractual protections disappear, everyone gains a new person to distrust. The provider distrusts the relay, the relay distrusts its account supplier, the customer distrusts the relay, and the account supplier distrusts whoever sold them the credentials. And everyone keeps using the system, because the price is good.

Security researchers Jeremy Kirk and Mathew Woodyard at Okta found a small opening into one such service. They had been examining transfer stations advertising steeply discounted model access, one of which claimed to route customer requests through accounts containing bonus credits and to charge only 5 to 15 percent of official token prices. Normally the service was opaque. Then the researchers found an exposed status endpoint, reporting 881 users, 872 of them marked active.

The figure did not establish that 872 criminals were online, or prove that every upstream account was stolen. But the mistake turned an advertisement into evidence of an operating system. Somewhere behind the cheerful discount was a pool large enough to require status monitoring, replacement inventory and an abstraction layer between customer and source. For a moment the side door was open. Then it closed.

A black market in watches creates an obvious problem: the Rolex might not be a Rolex. A black market in intelligence creates the same problem, except that there may be no watch to inspect.

Earlier this year, a team of researchers at the CISPA Helmholtz Center for Information Security examined a group of what they called shadow APIs, unofficial providers claiming to sell access to well-known AI models. They found 17 shadow services appearing in 187 academic papers. The gray market had moved beyond hobbyists looking for cheap chatbot access: researchers were using these services in published scientific work. The team selected three providers, audited 24 model endpoints in depth, and asked a deceptively difficult question. Was the model behind the label actually the model being advertised?

An API gives the customer remarkably little to inspect. You send text and text comes back. There is no chassis number embedded in the prose. Anyone purchasing “GPT” or “Claude” through an intermediary is ultimately trusting a string in a configuration file.

The CISPA team compared behavior, performance and model fingerprints. In their bounded sample, 45.83 percent of the tested endpoints failed fingerprint verification, and another 12.5 percent showed significant deviations. Some endpoints claiming to represent expensive or sophisticated models behaved more like different, cheaper systems.

Those numbers have to be kept inside their fence. The researchers did not demonstrate that 45.83 percent of all transfer stations sell counterfeit models; they tested 24 endpoints across three providers, and some passed. But that modest denominator points at a larger problem, which is that even a sophisticated customer may not know what intelligence they have purchased.

A gray-market provider can cheat the official AI company upstream and then cheat the customer downstream, and the customer downstream may publish a scientific paper based on the result. The fraud acquires a lineage. A researcher believes they tested Model A. A paper reports Model A. Another researcher cites the paper. But the requests may have been answered by Model B, and the origin has disappeared into the interface.

The same opacity can conceal not only which model was used, but who paid for it. In 2024, researchers at the security company Permiso placed a cloud credential in a controlled honeypot, enabled logging for model invocations, and watched what happened after attackers discovered it. At first the stolen AI access was simply another compromised credential. Then the prompts began to reveal a business. According to Permiso, the access appeared to be powering an AI sexual-roleplay service, and over a two-day period the researchers observed more than 75,000 successful model invocations. The company linked the activity to a particular downstream service circumstantially rather than conclusively, and it did not publish a total victim loss.

The key economic transformation was visible all the same. Someone had stolen an entitlement to use a model. Someone else had packaged that entitlement inside a customer-facing product. The end user never had to know that the intelligence being purchased was running on somebody else’s cloud credential; from where they sat, the application simply worked. That is what a mature gray market accomplishes. It makes provenance irrelevant to consumption. The customer buys the answer and the supply chain disappears.

On February 23, Anthropic published an allegation that dramatically expanded the possible endpoint of this market. Three Chinese AI laboratories, DeepSeek, Moonshot AI and MiniMax, had generated more than 16 million exchanges with Claude through approximately 24,000 fraudulent accounts, the company said, and it characterized the operations as industrial-scale distillation campaigns.

The numbers came from Anthropic, and so did the attribution. That is important. Anthropic is not a neutral forensic auditor observing a dispute between strangers. It is the creator of the model allegedly targeted, a competitor of the companies it named, and an active participant in the political debate over restricting access to advanced AI technology. Its private telemetry has not been released for outsiders to independently reproduce. None of that makes the allegations false. It means they should be described for what they are: Anthropic’s findings.

Distillation itself is neither exotic nor inherently illicit. It is a standard technique in machine learning, in which a stronger model generates examples or judgments that help train a smaller or cheaper one, and AI companies routinely distill their own systems. The controversy begins when the teacher belongs to somebody else and the student obtains access through methods the teacher’s owner considers fraudulent or prohibited.

Anthropic said the three labs had used fraudulent accounts and proxy infrastructure to evade restrictions while targeting capabilities such as coding, reasoning, tool use and computer interaction. It attributed more than 13 million exchanges to MiniMax, more than 3.4 million to Moonshot and more than 150,000 to DeepSeek.

If the attribution is right, the scale changes the conception of the black market. The customer at the far end of the proxy is no longer simply a programmer hoping to save money. It may be another AI development pipeline. Inference obtained fraudulently is not necessarily resold as inference; it can become data, and that data can become another model.

This is where the language surrounding AI theft becomes especially treacherous. A million improperly obtained conversations are not the same thing as stealing a million-dollar machine or copying an entire model. Evidence of fraudulent access does not establish which later capabilities in a rival model were caused by that access. Anthropic can have strong evidence that the accounts existed without proving every subsequent capability was derived from Claude. The temptation is always to advance one step beyond the evidence: a blocked transaction becomes money stolen, an account becomes tokens stolen, model outputs become a model stolen. The reliable version of the story stops one step earlier.

What Anthropic says it observed is significant enough on its own: thousands of accounts, millions of interactions, infrastructure intended to make the accounts harder to connect to one another, and highly targeted querying that Anthropic believed was designed for model development. The alleged buyer was no longer merely consuming intelligence. It was manufacturing more of it. The black market had reached the factory floor.

The easiest way to misunderstand this story is to ask how many dollars of AI tokens have been stolen. There is no good answer, because the question assumes the market has already produced a single ledger. It has produced at least two. One records money and the other records computation, and the two move on different clocks.

A model request settles almost instantly. The customer asks, GPUs work, the answer arrives. A payment can remain unsettled for much longer. A card may initially authorize. A fraud system may later detect a pattern. A cardholder may discover the transaction and file a dispute. A chargeback may arrive. The money can travel backward long after the intelligence has traveled forward.

Identity moves on a third clock entirely. Thousands of accounts may look unrelated until telemetry links them. A cloud credential may function for weeks before anyone realizes it has been compromised. A relay may keep selling access while its suppliers vanish one by one. A customer may finish an entire research project before discovering that the model behind an API label was not what the seller promised. The economic opportunity lives in the gaps between those clocks.

This explains why AI companies increasingly find themselves performing work that seems only tangentially related to artificial intelligence. OpenCode correlates application telemetry with payment data. Cursor rewrites product policies around adversarial behavior. Stripe studies identities across merchants, cloud companies watch for stolen credentials, researchers fingerprint models, and providers demand more identity verification. Each intervention tries to answer some version of the same question: who is actually making this request, and what exactly are they entitled to consume?

There is no painless answer, because a requirement that stops a fraudster can stop a legitimate customer too. Demanding a Western credit card may reduce abuse while excluding developers in countries where such a card is difficult to obtain. More identity verification may make account farms expensive while making anonymous or privacy-conscious use impossible. Less generous subscriptions reduce arbitrage while making legitimate experimentation costlier.

The product designs that accelerated AI adoption also created this dilemma. The industry wanted low prices, generous trials, easy model switching and almost no distance between curiosity and consumption. Those choices changed what there was to steal.

In an earlier era, a hacker stole the database, the credit-card number or the software. In the AI economy, the valuable thing is more ephemeral: the right account, the remaining allowance, the valid API key, the unused promotion, the subscription that can still be driven harder, the identity whose payment has not yet been reversed. What the black market sells is not intelligence in the abstract. It sells claims on somebody else’s machinery.

Sometimes those claims were acquired legitimately and resold in ways the provider dislikes. Sometimes they exploit regional restrictions or abuse promotions. Sometimes they rely on compromised credentials or stolen cards. Sometimes the customer is the one being cheated. The supply cannot be reduced to one criminal origin, which is precisely why the market is resilient. A gateway does not care very much where the next working account comes from, and neither does the software connected to it.

All of which makes the black market look strangely similar to the legitimate AI market above it. Both are obsessed with routing. Both pool supply, switch among models and optimize for price and availability. Both build abstractions so the customer does not have to know which server produced the answer. Both turn intelligence into a metered commodity. The difference is that one market is trying to preserve provenance and the other profits from its disappearance.

Six days before the latest wave of spectacular fraud screenshots, Stripe announced that it had agreed to acquire OpenRouter, a legitimate service that it said routes requests across more than 400 AI models from more than 80 providers. There is nothing sinister about the transaction, but it says something about where the industry is heading. Stripe built infrastructure for routing money. OpenRouter built infrastructure for routing intelligence. The fraud problem lives where those two systems meet.

Did the payment clear? Did the account legitimately belong to the person using it? Was the inference lawfully obtained? Was the model actually the model advertised? Those questions used to belong to separate industries. Now they can all describe a single API request.

At Microsoft, another gigawatt of computing capacity comes online. At an AI startup, somebody decides how much of that distant industrial abundance can safely be hidden behind a free trial. Somewhere else, a script creates another account.

The AI boom spent staggering sums making intelligence abundant. What the shadow market recognized was what abundance does to anything that can be measured. It gives it a unit. The unit gets a price. The price creates an arbitrage. And eventually someone discovers that what the industry has been calling generosity is also inventory.