If someone offers you Claude or GPT-5 API access at 80% off list price, what are you actually buying — cheaper tokens, or a stranger's proxy sitting between you and the model?
That's the question independent researcher Matt Lenhard set out to answer in "The AI Credit Resale Economy" (vectoral.com), a piece that hit 229 points and 89 comments on Hacker News in August 2026. Lenhard found a real, documented gray market reselling AI API credits and subscription access — OpenAI, Anthropic/Claude, Google Gemini, Azure, AWS, MiniMax, ElevenLabs, and more — at discounts typically running 30% to 98% off list price. For explainx.ai's audience of people building AI products and watching their API token spend, the pitch is obviously tempting. The mechanics of what you're actually plugging into are less obvious, and for anyone running an agent harness like Claude Code through one of these, the risk goes well past "did I overpay."
What is the AI credit resale market?
It's a loose collection of marketplace sites, router services, and informal channels where sellers list discounted access to major AI providers' APIs and subscription tiers.
Lenhard documented three distinct layers:
- Dedicated marketplaces — sites named in his research as "AI Credits" and "AICreditMart," where sellers list credits for sale with a selectable discount range. His example screenshot showed a slider offering 40-80% off.
- Bulk-discount routers — services like CheapCredits, Tokvana, and Neokens that advertise a flat discount across every model by claiming bulk-purchasing power. CheapCredits, for instance, advertises a flat 40% off every model's list price.
- Informal channels — active resale activity on Telegram, plus sporadic posts on Reddit communities like r/saasforsale and r/indiehackers. One example Lenhard found: someone trying to resell roughly $2,500 of OpenAI credits they'd received free from joining YC's Startup School program.
Lenhard's rough estimate, based on surveying these sites, forums, and direct broker contacts: probably "tens of millions" of dollars worth of AI credits are being offered across this gray market at any given time.
Why does this arbitrage even exist?
The honest, non-conspiratorial answer is a pricing gap between subscription plans and metered API billing.
Claude's $200/month "Max 20x" tier, for example, delivers API-equivalent value that would run into the thousands of dollars if billed at raw per-token API pricing. That gap — flat subscription price versus metered API cost — is a major structural reason reselling is profitable on its own, with no fraud required. Someone with a subscription they're not fully using, or a startup sitting on unused credits from a program like Startup School, has a real incentive to sell the surplus, the same logic that drives resale of airline miles or hotel loyalty points.
That legitimate layer is real. It's also not the whole story.
How much of the supply is stolen?
Lenhard, responding directly in the Hacker News thread, confirmed a meaningful share of the supply is funded by credit card fraud: stolen cards used to buy credits, which get resold before the chargeback catches up. Based on conversations with companies affected by this activity, he estimated roughly 10-20% of what he saw was outright fraud — an honest, explicitly caveated ballpark, not a precise figure. He also noted the caveat cuts both ways: his sample likely skews toward the worst cases, since the companies motivated to talk to a researcher about credit fraud are disproportionately the ones who got burned.
The rest of the fraud-adjacent supply is closer to the legitimate-arbitrage case above — people or startups reselling access or benefits they genuinely received but don't need.
The real risk for developers: what happens when you proxy through a reseller
This is the part that matters most for explainx.ai's audience, and it's more technical than "you might get scammed."
Lenhard directly contacted a broker claiming their account could spend $100k/day. The broker did not hand over a real provider API key. Instead, they operate as a proxy: requests get routed through the broker's own endpoint, "probably picking from a pool of keys" behind the scenes. That single fact is the root of every downstream risk here.
1. You may not be getting the model you're paying for
When your request goes through someone else's relay instead of directly to Anthropic, OpenAI, or Google, there's no way to verify server-side that the response actually came from the model you selected. HN commenters in the thread cited real examples of resold "Claude" access that, on closer testing, turned out to be a cheaper model — a Kimi-based distillation, in one case — dressed up and passed off as genuine Claude output. If you're using the output for anything where model quality or provenance matters (code review, medical or legal drafting, benchmarking), you're evaluating the wrong model.
2. Your TLS session terminates at their server, not the provider's
Normal API calls to Anthropic or OpenAI are end-to-end encrypted straight to the provider. Route through a reseller's proxy and that chain breaks: TLS terminates at their infrastructure first, meaning they can log, inspect, or resell everything that passes through before it's re-encrypted and forwarded (if it's forwarded at all). CheapCredits reportedly even offers a formal Data Processing Agreement citing GDPR Article 28 and Standard Contractual Clauses, listing OpenAI and Anthropic as "sub-processors" — real-looking compliance paperwork wrapped around a resale operation that, by its own architecture, breaks the privacy guarantee that paperwork is supposed to certify.
3. Agentic tool calls can be tampered with in transit
This is the most serious and most explainx-relevant risk in the entire story. If you're running a coding agent — Claude Code, Codex, or similar — through a reseller's relay, the proxy sits in the path of every tool call the agent makes, not just chat completions. A malicious or compromised relay can tamper with tool-call outputs: injecting an extra command into a bash call, altering a file-write payload, or exfiltrating secrets that pass through the session. One HN commenter cited relevant research on the risk of untrusted LLM proxies manipulating agent tool calls — this is functionally the same threat class as the indirect prompt injection and memory-exfiltration attacks explainx.ai has covered elsewhere, except the attacker doesn't need to compromise your prompt at all — they just need to sit on the wire you willingly routed your agent through. If you wouldn't run Claude Cowork through an unaudited third-party relay, the same logic applies to any agent harness with shell or file-system access.
The takeaway isn't "resold credits always do this." It's that once you're on an unverified proxy, you have no way to know whether they do — and the failure mode for a coding agent is a lot worse than a wrong chatbot answer.
The China angle: why this is already semi-normalized there
This isn't purely a fringe gray-market curiosity. In China, where OpenAI and Anthropic services are geo-blocked, resold token access via relay proxies has become a common — almost normalized — way for developers to reach US frontier models, according to a HN commenter and a linked ChinaTalk article on buying cheap Claude tokens. The dynamic got interesting enough to be self-defeating for some users: because resold-proxy pricing for ChatGPT and Claude access was already inflated relative to DeepSeek's real API pricing, some Chinese developers reportedly didn't realize just how cheap DeepSeek actually was — they'd only ever paid resold-proxy prices for the US models, which obscured the real cost comparison.
Is there a partial mitigation if you do use one of these?
If someone chooses to route through a proxy anyway — resold or otherwise — there is at least one constructive, practitioner-facing option: community-built proxy tools, such as a plugin ecosystem around the open-source CLIProxyAPI project, let you place your own filtering and data-loss-prevention (DLP) layer in front of any proxy, including a reseller's. That layer can scan and redact secrets or sensitive content before it ever leaves your machine — a partial mitigation, not a fix for model substitution or tampered tool calls, but a real reduction in blast radius for secret exfiltration specifically.
Tells of a risky reseller vs. a legitimate discount path
| Signal | Risky reseller | Legitimate option |
|---|---|---|
| Access method | Proxy/relay only, no real provider API key | Direct API key from the provider, or a transparent router |
| Price | Implausibly low — 90%+ off list | Modest, explainable discount (volume, subscription arbitrage) |
| Identity | No verifiable company, Telegram/Reddit contact only | Registered company, public pricing page, support channel |
| Model verification | No way to confirm you're getting the paid model | Provider-issued model IDs, response headers you can audit |
| Logging policy | Undocumented or wrapped in unverifiable compliance claims | Published, auditable logging/retention policy |
Legitimate ways to actually cut your AI spend:
- Unified API routers with transparent policies — services like OpenRouter let you compare providers and route traffic while keeping a documented, auditable path to the underlying model.
- Official volume/enterprise pricing — negotiated directly with Anthropic, OpenAI, or Google; you get a real contract and real support, not a Telegram handle.
- Open-weight self-hosting — running an open model yourself, on your own infrastructure or through a local-first gateway like OmniRoute, removes the third-party-proxy trust problem entirely because there's no relay to trust.
- Track real per-token costs — understanding how tokens are actually billed makes it much easier to spot when a "discount" is too good to be structurally explainable.
Lenhard's follow-up piece (not the primary source here, but worth knowing about) goes deeper into "token brokers" specifically — people who buy unused startup credits directly and flip them — and describes startups receiving direct inbound solicitation emails offering to buy or sell "off-market inference" credits. The pattern is spreading, not shrinking.
The bottom line
A meaningful chunk of the AI credit resale market is legitimate arbitrage on the gap between flat subscription pricing and metered API costs — no different in spirit from reselling airline miles. But Lenhard's own estimate puts roughly 10-20% of what he investigated as straightforwardly fraud-funded, and even the non-fraudulent share routes your traffic through an unverified third party that can substitute models, break end-to-end TLS integrity, and — for anyone running an agentic coding tool — tamper with the exact tool calls that touch your file system and secrets. If you're tempted by a 40-80%-off Claude or GPT offer, the question to ask isn't just "is this legal." It's "who's actually sitting between me and the model, and what can they see or change while they're there."
Related reading
- MCP security guide: risks and mitigations for AI agent tooling
- Is Claude Cowork safe? Security vulnerabilities explained
- GitLost: prompt injection leaked private GitHub repos
- Claude Memory Heist: web_fetch data exfiltration
- What are LLM tokens? A plain guide to API billing
- Claude usage limits in 2026: every change explained
- DeepSeek V4-Pro's permanent API pricing discount
- OmniRoute: a free, local-first AI gateway alternative
Pricing, discount ranges, and platform names referenced above reflect Matt Lenhard's research and the Hacker News discussion as of August 2026; verify current terms directly with any provider or router before relying on them.