Inference Abuse Gets Liquid

If You Only Read One Thing

AI security now has a spread: the falling chance that poisoned content redirects Opus, and the 97.8% discount offered by relays selling hijacked inference. Token Theft Finds Liquidity and Opus Shrinks The Attack Window show attackers and defenders optimizing different numbers. The decisive question is which number sets the cost of a successful agent compromise.

Token Theft Finds Liquidity

An investigation published in June and surfaced by Simon Willison on Sunday maps a shadow market with a price signal. One reseller offered $3,333 of official Anthropic credit for 425 RMB, a 97.8% discount. That is not cheap inference. It is an abuse subsidy with a storefront.

Matt Lenhard tracked 49 token relays: OpenAI-compatible proxies that accept a customer’s request and route it through pools of model credentials. He describes four layers beneath the chat-completions endpoint: card and account merchants obtain credentials; account pools automate their use; relays package the capacity behind familiar APIs; directories and resellers bring in buyers. The ten largest relays drew a combined 3.6 million monthly visits. One directory even runs a daily lottery for 50 API keys advertised with $100 balances; a recent round attracted 1,150 tickets.

Some inventory is legitimate arbitrage. A relay might aggregate accounts for customers who cannot pay a foreign vendor. But Lenhard also found free-trial farming, chargebacks, stolen cards, prepaid-card abuse and poorly protected support chatbots. Coding assistants become supply when their credentials can be extracted or their endpoints driven outside the intended interface. Neutral proxy projects including one-api and new-api make the last mile easy; the software does not determine whether the credential behind it was bought, stolen or minted from a trial.

Why it matters: A leaked key is no longer merely a private incident between one developer and one vendor. The relay market converts it into inventory, spreads its value across many buyers and creates a financial incentive to search every agent, support bot and bundled coding product for unmetered access. Frontier providers can make direct account creation more expensive, but that pushes acquisition toward the applications they supply. Hard per-key spending locks, identity clustering, concurrency controls and budget reserved for in-flight requests therefore become security controls, not billing niceties. Evidence of relays surviving those controls without relying on fraud would weaken this thesis; evidence that vendors begin enforcing them would confirm where the pressure landed.

Room for disagreement: The investigation relies partly on forum posts and seller claims, traffic is not paid consumption, and a steep advertised discount does not prove every credential is stolen. Some relays solve real payment and regional-access problems. The evidence establishes an organized market and its methods, not a clean estimate of fraudulent token volume.

Opus Shrinks The Attack Window

Saturday’s briefing treated Claude Opus 5 as a task-economics release: more effort buys more capability, latency and cost. Buried in the system card is a separate deployment result. Opus 5 appears materially harder to redirect with instructions hidden inside the content an agent reads.

That attack is indirect prompt injection. A user asks an agent to summarize a web page or inspect a repository; text inside that trusted workload tells the model to ignore the user and take another action. Ordinary refusal training is not enough because the hostile instruction arrives through data the application deliberately supplied. The relevant unit is the model-plus-tools loop, not an isolated chat answer.

In Anthropic’s system card, Gray Swan’s benchmark gave Opus 5 a 2.0% attacker success probability within 15 attempts, down from 5.5% for Opus 4.8. GPT-5.6 Sol scored 20.0% in the same table. Anthropic’s adaptive coding benchmark used 40 scenarios and 200 attempts per scenario: Opus 5’s attack success was 0.56% without safeguards and 0.18% after prompt-injection probes inspected tool results. Separately, Anthropic’s product-level Auto Mode adds a classifier that can block dangerous outgoing tool calls. The layers operate on both sides of the agent: the model resists the instruction, then the runtime inspects what came back and what is about to leave.

Why it matters: Prompt injection has often been treated as a permanent application tax—assume the model will obey poisoned context, then compensate with permissions and human approval. A lower base attack rate changes that budget. Runtime defenses can focus on ambiguous, high-impact actions instead of trying to catch every hostile string, while model routing can include injection resistance alongside price and coding quality. Independent red teams reproducing the gap on live browser, email and repository tasks would confirm that the result travels; convergence toward older-model failure rates would falsify it.

Room for disagreement: These are Anthropic-reported benchmarks, public prompt-injection tests may be saturating, and the Opus 5 bug bounty was still being established when the card was written. Sonnet 5 also posted a lower safeguarded attack rate on Anthropic’s adaptive coding set, so Opus is not uniformly best. The measured gain is promising evidence, not a transferable security guarantee.

The Contrarian Take

Everyone says: A 97.8% token discount proves frontier inference is already a commodity and official API prices have nowhere to go but down.

Here’s why that’s wrong: A market price only describes production cost when the seller pays for the inputs. Trial abuse, stolen cards, extracted application credentials and chargebacks move the bill to someone else. The discount measures how efficiently attackers can monetize weak identity and billing controls, not how cheaply a clean provider can run the model. The durable signal is the existence of liquid resale: every generous endpoint now has a quoted theft value.

Under the Radar

TRIM removes the search residue from successful agent patches — Agent trajectories often leave speculative edits that pass tests but are irrelevant to the final fix. TRIM reports 17.9% to 32.9% less functionally unnecessary code, while a cheaper variant produced the same patch 96.4% of the time and preserved the SWE-bench oracle in 99.1% of cases. No public implementation surfaced, so this is a method to watch rather than a tool to adopt.
Vercel turns framework documentation into an agent dependency — The AI SDK repository now recommends npx skills add vercel/ai, installing framework guidance in a form coding agents can retrieve during work. That is more than convenient documentation: versioned skills become part of the build environment, with the same freshness and provenance questions as any other development dependency.

Quick Takes

Kimi K3 reaches its evidence date without public weights yet. Moonshot promised the model’s weights by July 27, but its official Hugging Face organization still listed 18 models from K2 and earlier families at publication time. The day is not over, so this is a clock check rather than a broken promise; until artifacts appear, K3’s open-model proposition remains an access claim. (Source)
Ruff made lint migration an agent benchmark. Version 0.16 raised its default enabled rules from 59 to 413. Simon Willison found 1,618 new errors in sqlite-utils, 1,538 automatically fixable, then used Codex and Claude Code to migrate three repositories. Coding agents are becoming the labor that lets infrastructure projects ship stricter defaults without imposing the full transition cost on maintainers. (Source)
PyPI closed an old-release poisoning window. The registry now rejects new files uploaded to releases older than 14 days, after the LiteLLM and Telnyx compromises showed how a trusted historical version could acquire a malicious wheel later. Only 56 of the top 15,000 packages had recently added Python 3.14 wheels that late. Compatibility loses a rare escape hatch; dependency resolution gains a stable historical record. (Source)

The Thread

AI security is becoming a market-design problem. Opus lowers the probability that one prompt-injection attempt works; relays raise the payoff from every credential attack that does work by supplying distribution and buyers. PyPI’s 14-day lock uses the same logic on package compromise by shortening the interval in which stolen authority can be monetized. The shared variable is attacker return, not the location of the bug. As model-level resistance rises, acquisition shifts toward credentials and applications unless identity checks, spending locks and time-bounded artifacts make that inventory expensive to source and quick to expire. A safer model changes the odds; a liquid resale market decides whether attackers keep placing the bet.

Prediction Ledger

Weekly Scorecard

Provider-owned benchmark verification: Made April 21, medium-high confidence. Wrong: Kimi retained its verifier and Artificial Analysis benchmarked providers, while CoreWeave published one result, but three qualifying provider-owned submissions did not surface by July 21.
Reasoning-driven video modes: Made April 22, high confidence. Wrong: No two of Seedance, Veo, Runway, Kling or Sora shipped a qualifying reasoning-driven generation mode by July 22.
Edit minimality as a product metric: Made April 23, medium-high confidence. Wrong: Research and tooling measured unnecessary changes, but Cursor, Copilot, Claude Code and Codex did not publish it as an official metric or training objective by July 23.
A platform-owned harness postmortem: Made April 24, medium confidence. Wrong: Independent studies blamed harnesses for coding-agent regressions, but Codex, Cursor and Windsurf did not publish a qualifying engineering postmortem by July 24.
Reasoning-faithfulness rewards in a frontier recipe: Made April 27, medium-high confidence. Wrong: No qualifying Anthropic, OpenAI, Google DeepMind, DeepSeek or Alibaba/Qwen recipe cited a Causal Importance of Reasoning-style or chain-of-thought-faithfulness auxiliary reward by July 26.

What I Got Wrong

I repeatedly promoted interesting research concepts into vendor road maps without enough precursor evidence. The better forecast starts from a control, metric or workflow already shipping in a product, then predicts the next observable commitment—not the lab’s adoption of an elegant idea.

New Prediction

I predict: By September 30, 2026, at least one major model API or gateway among Anthropic, OpenAI, Google, Vercel, Cloudflare or OpenRouter will document a hard per-key dollar lock that rejects requests at a period threshold, not merely an alert or soft project budget. No such documented enforcement control by that date makes this prediction wrong. (Confidence: medium; Check by: 2026-09-30)

Issue date: July 27, 2026 · Generated: 3:59 AM EDT