Somewhere in your founder’s inbox this month there is an email offering frontier model access at 40% off list price. Not a promotion, not a startup programme, not a reseller agreement with a logo you recognise. Just a stranger with an API endpoint, a discount and a plausible explanation.
An investigation published this week traced that offer back to a functioning secondary market in AI credits, one that reportedly moves tens of millions of dollars in credits across marketplaces, Telegram channels and direct broker outreach. It reached the front page of Hacker News, which is usually the moment a grey market stops being a curiosity and starts turning up in procurement conversations.
The economics look compelling. The offer is also, in almost every case, the most expensive way a company can buy inference.
TL;DR
- A secondary market in AI credits now offers 30-80% discounts on frontier model access through marketplaces, bulk-discount routers and direct brokers, with individual sellers claiming six-figure daily spending capacity.
- Brokers almost never hand over a key. They hand over a proxy endpoint, which means every prompt and every response passes through an intermediary you cannot audit, and model substitution is undetectable without deliberate testing.
- Reselling account access breaches the major providers’ terms. OpenAI’s Services Agreement states customers “may not resell or lease access” to their account, and enforcement in 2025-2026 has been swift and public.
- Under GDPR the broker is an undisclosed sub-processor. A data processing agreement from an anonymous Telegram seller is decorative, not compliant.
- The demand behind this market is legitimate. Committed-spend agreements, batch endpoints, prompt caching and deliberate model routing deliver comparable savings without putting your inference supply chain in the hands of a stranger.
How the market actually works
Three distinct models have emerged, and they are worth separating because the risk profile differs.
Credit marketplaces match holders of unused credits with buyers. Listings reportedly run at 30-80% below list, with sellers choosing a delivery method at sign-up. The mechanics resemble a gift card exchange, which is roughly the level of diligence involved.
Bulk-discount routers present as legitimate infrastructure. They advertise flat discounts across all models, sometimes a clean 40%, and justify it as volume purchasing. Several publish data processing agreements and GDPR compliance claims. They look like an AI gateway, and that resemblance is the point.
Direct brokers email founders. One reportedly offered $100,000 a day in spending capacity. Supply is not the constraint in this market.
The common thread matters more than the differences: buyers receive an API endpoint, not a key. The broker sits in the request path as a proxy. That single architectural fact is where the actual cost lives.
You cannot audit what you cannot see
When a broker operates the endpoint, the substitution risk is not theoretical. You request an expensive frontier model. What returns is a response that looks like a frontier model response. Nothing in the payload proves which model produced it, and a broker whose margin depends on the spread between what you paid and what they spent has a standing incentive to route your traffic somewhere cheaper.
The commenters on the Hacker News thread went further, and the concerns are ones any engineering leader should recognise: prompt and response logging by an unaccountable party, injection of modified content into responses, and the observation that discounts at the extreme end are more consistent with model distillation than with resale arbitrage. Nobody has to be malicious for this to end badly. They only have to be under-capitalised.
Meanwhile everything you send is going through that pipe. Client code. Customer records in a RAG context. Internal documents. Support transcripts. The same data you would never hand to an unvetted vendor is now leaving your network to an entity whose legal name you may not know.
The contract you have quietly broken
This is the part that turns a cost decision into a business continuity decision.
Provider terms prohibit this. OpenAI’s Services Agreement is explicit that a customer “may not resell or lease access to its Account or any End User Account”. Anthropic’s commercial terms carry comparable restrictions on redistribution and on building competing services. The seller is breaching their agreement. You are buying access that the provider never authorised.
Enforcement is not hypothetical. Anthropic revoked OpenAI’s access to Claude over an alleged terms breach in August 2025, and has since moved against unauthorised third-party harnesses reselling or repackaging access. When an account in that chain is terminated, the capability disappears mid-production. You have no relationship with the provider, no support channel, no notice period and no standing to appeal. Your incident response consists of emailing a Telegram handle.
Ask what that outage costs against the 40% you saved, and the arithmetic resolves quickly.
The compliance maths nobody runs
For any business handling EU personal data, the broker is a sub-processor. That triggers real obligations: a written Article 28 contract with an identifiable legal entity, disclosure in your records of processing, sub-processor notification to your own customers, and a defensible answer about where the data goes and how long it lives there.
A DPA published on a website with no company registration behind it satisfies none of that. It is a PDF. And if you are shipping to enterprise buyers, the security questionnaire will eventually ask you to list your sub-processors, at which point you either disclose an anonymous broker or answer inaccurately in a contractual document.
The wider governance picture is not encouraging. Research this year put shadow AI at roughly 4-9% of enterprise software spend, typically two to three times the AI line finance had budgeted. In one 2026 benchmark of procurement teams, 47% used AI daily while only 17% had an enforced AI governance policy. Discounted credits do not enter a company through procurement. They enter through an engineer with a corporate card and a deadline.
Why this market exists, and what to buy instead
The demand is rational. Inference is now a material line item, the subsidised pricing of the early cycle is unwinding, and finance teams are asking questions they were not asking eighteen months ago. Teams reaching for a broker are usually responding to real budget pressure with the only lever they can pull without a procurement conversation.
There are better levers, and most companies have not pulled any of them.
- Negotiate committed spend. If your monthly inference bill is large enough that a 40% discount is tempting, it is large enough to warrant an enterprise conversation with the provider. Volume discounts exist through the front door.
- Use the discounts already on the price list. Batch endpoints, prompt caching and off-peak processing deliver substantial savings on workloads that are not latency-sensitive. Most teams have never audited which of their calls are genuinely synchronous.
- Route deliberately. Tiered routing sends cheap tasks to cheap models by design, with evaluation to prove quality holds. That is the same saving a broker offers, except you chose it and you can measure it.
- Make egress a policy, not a preference. Route all model traffic through a single gateway, allowlist provider base URLs, and alert on outbound inference calls to unknown endpoints. If an engineer can point a base URL at a stranger’s proxy without anyone noticing, your controls are prompts rather than controls.
- Inventory your credits. Accelerator and cloud programmes hand out substantial allocations that expire unused. Knowing what you hold and when it lapses removes one of the reasons this market has supply in the first place.
- Name an owner for AI spend. Per-team budgets, usage dashboards and a named person accountable for the number. Governance is cheaper than the discount.
The signal underneath the discount
Tokens have become a pseudo-currency, and grey markets are what commodities get once they are liquid enough to arbitrage. Expect the providers to respond the way payment networks did: tighter account verification, resale detection, and terminations that catch buyers as well as sellers.
The strategic read is not “avoid brokers”, which is obvious. It is that inference is now a supply chain, and most companies are managing it with less rigour than they apply to office stationery. Single provider, no contract, no exit path, no attestation that the model you paid for is the model you got. The broker market is simply the first place that gap has been priced.
At REPTILEHAUS we build and run AI systems for entrepreneurs and management teams: gateway and routing architecture, cost governance that survives a finance review, evaluation harnesses that catch quality regressions before your customers do, and the DevOps to keep it all accountable. If your inference bill has grown faster than your controls, get in touch.
📷 Photo by noodle kimm on Unsplash
