Dark Token Economy: Unauthorized LLM API Proxies Harvest Prompts for Fraud and Distillation

The dark token economy is a parallel market where unauthorized proxy services resell access to frontier LLMs like Claude, GPT, and Gemini at up to 90% below official pricing. Proxy operators source tokens through fraudulent or pooled accounts, silently swap requested models for cheaper alternatives in nearly half of calls, and log every prompt and response that passes through their servers. The harvested data feeds downstream fraud and model distillation. The market is concentrated in China due to geo-restrictions but can grow globally as frontier-model token prices rise.

What are Dark Tokens?

Dark tokens are LLM API tokens sourced from a parallel market that resells unauthorized access to frontier models through fraudulent or pooled accounts behind attribution-stripping proxies, typically at a fraction of official rates. The term covers the full chain: stolen or farmed credentials at the supply end, proxy infrastructure in the middle, and resold API keys at the customer end.

The market is concentrated in China due to geographic blocks, but demand is global, and rising frontier-model prices are accelerating it. As the spread between official and dark-market pricing widens, the arbitrage opportunity grows for operators in this market.

How Does it Work?

Proxy operators use three revenue levers, often stacked together on the same transaction.

• The first is price arbitrage. Operators farm free-trial accounts, resell educational and startup quotas, exploit regional discount programs, and split paid subscriptions across multiple users. This sources tokens below cost, which are then marked up for resale. Margins are thin and depend on volume, which requires a steady supply of verified accounts. That supply comes from a specialist chain: biometric harvesters generate face videos and ID scans, SMS verification farms provide phone numbers, and account farmers assemble the credentials into usable accounts.
• The second is silent model swapping. A customer pays for Claude Opus 4.7 and receives Haiku or an open-weight model like Qwen. The proxy pockets the cost difference. This happens in nearly half of all calls across the 17 shadow APIs CISPA tested. On medical benchmarks, accuracy dropped from 83.82% (official Gemini 2.5 Flash) to roughly 37% through shadow APIs. Safety scores were equally unreliable, either muted or amplified to nearly double.
• The third is log harvesting, which is where the real money is. Every prompt and response that transits the proxy is logged on the operator’s server. That corpus has two downstream uses: lead generation for targeted fraud (financial details, business logic, personal data from prompts) and training data for model distillation.

Distillation is a standard machine learning technique where a smaller model is trained to replicate the behavior of a larger one. Labs do this routinely with their own models. The concern here is not distillation as a method but the data source. When proxy operators harvest reasoning traces from thousands of unsuspecting users and publish them as training datasets, the resulting “distilled” models are built on stolen outputs.

On Hugging Face, the indicator is not the word “distilled” by itself. The red flag is a model trained on proprietary closed-model outputs (Claude, GPT) where the uploader has no institutional affiliation, no disclosed API budget, and no clear explanation for how they generated that volume of data through legitimate means.

Multiple Claude reasoning-trace datasets that appear to originate from proxy logs have surfaced on Hugging Face, used for fine-tuning open-weight models.

Who is Involved?

The Weather Report identified 8 public GitHub repositories that openly facilitate unauthorized API resale, with a combined ~172,000 stars. Two of them, CLIProxyAPI and claude-relay-service, were named by Mandiant as tools used by PRC-nexus actor UNC5673. CISPA found that 11 of the 17 shadow APIs they audited run on one-api or its fork new-api, two open-source API gateway frameworks that are dual-use but heavily adopted by proxy operators.

Public API proxy repositories – Source: The Weather Report

Most transactions happen off GitHub though. Payment flows through WeChat and Alipay, support runs in QQ groups, listings appear on Xianyu (Alibaba’s secondhand marketplace), and contact details are published directly in repository READMEs.

Other than the identified ones, there are various repositories, websites, and directories for other transfer stations.

Who is Exposed

The direct risk applies to any organization or developer routing LLM API calls through a third-party provider that is not an official API partner. This includes teams using discount API brokers, startups cutting costs through reseller channels, and research groups accessing models through unofficial endpoints.

The user base spans university professors, students, tech workers, individual developers, and hobbyists. The risk is highest in regions where frontier models are geo-blocked (China, Iran, Russia), but it extends globally wherever cost pressure pushes buyers toward cheaper alternatives.

An indirect risk hits organizations whose employees or contractors use these proxies without central IT awareness. Prompts containing proprietary code, internal documents, customer data, or business strategy are logged by the proxy operator and leave the organization’s control permanently.

What are the Risks?

The prompt logs harvested by proxy operators are a high-value asset with multiple uses:

• For fraud, they contain financial details, authentication patterns, personal information, and business logic that users disclosed in conversation with the model.
• For distillation, the reasoning traces from frontier models (especially Claude Opus chain-of-thought outputs) are exactly the training data needed to fine-tune cheaper open-weight models.

There is also the reliability risk which is immediate for organizations that unknowingly consume dark tokens through a supply chain. A model swap from Opus to Haiku or Qwen degrades your output quality silently. If your application depends on a specific model’s reasoning capability (medical triage, code generation, legal analysis), a swap can produce subtly wrong outputs with no error signal.

What to do

• Pin and monitor your API endpoints
• The most direct detection method. Proxy services work by overriding ANTHROPIC_BASE_URL or its equivalent to point at their own relay server. Lock official API base URLs in your configuration management and enforce them through egress controls rather than relying on environment variables that individual developers can override. Audit CI/CD pipelines and deployment configs for unauthorized endpoint changes. If the base URL has been changed and nobody on the team can explain why, treat it as a confirmed indicator.
• Run model-verification checks
• Implement periodic canary queries: known-answer prompts sent to your API endpoint, with responses compared against baselines from the official API. Silent model swaps produce detectable differences in reasoning style, knowledge boundaries, and refusal behavior.
• Track output quality over time
• If your LLM-dependent application starts producing lower-quality outputs and no code, prompt, or model version has changed on your end, a silent model swap upstream is a plausible cause. Automated output-quality benchmarks on a regular cadence give you the data to spot this. The key is having a baseline to compare against, which means you need to start measuring before you suspect a problem.
• Audit third-party providers before and after onboarding
• If you use an LLM API reseller or aggregator, verify their upstream relationship with the model lab. Ask for proof of an official partnership or API agreement. Legitimate distributors (AWS Bedrock, Google Cloud Vertex AI) can document this. Discount brokers typically cannot. Also check billing geography: if the provider’s payment processor, hosting infrastructure, or registered entity sits in a region that doesn’t match their stated location, that’s a flag worth investigating.
• Inventory shadow AI usage across your teams
• Developers under cost pressure may adopt discount API services without going through procurement. Centralizing API access through an approved gateway gives you visibility into what models are being called and through which endpoints. Survey development teams explicitly, and monitor network egress for connections to known LLM API domains from unauthorized sources.
• Treat any unofficial endpoint as an untrusted data processor
• If sensitive data (proprietary code, customer information, internal documents) has been sent through a proxy, treat it as a potential data breach. Prompt content logged by a proxy operator leaves your control permanently and can surface in distillation datasets or fraud pipelines. Follow your incident response procedures accordingly.

Conclusi̇on

The dark token economy is unlikely to produce a single dramatic breach or a security incident. Prompt data is leaking through thousands of small proxy operators simultaneously, and the downstream uses (fraud, distillation, targeted social engineering) are hard to trace back to the original exposure. An organization that routed API traffic through a proxy for six months may never learn that its internal documents ended up in a training dataset or that its customers’ financial details were sold to a fraud ring.

The more pressing near-term risk is silent model degradation. Applications that depend on a specific model’s reasoning quality can fail in subtle, hard-to-diagnose ways when the underlying model is swapped without notice. In high-stakes domains like medical triage, legal analysis, or financial modeling, those failures carry real consequences, and the absence of an error signal means they can persist for weeks or months before detection.

If you’re not in a geo-blocked region, you probably won’t end up using a transfer station on purpose since you can have direct API access to any model you need. The more realistic ways this touches you are indirect. An offshore dev team quietly routing calls through a proxy, a startup picking a discount API broker without asking how the discount works, or a developer copying a cheap provider config from a side project into production. There’s also the supply chain angle, where malicious npm or PyPI packages plant proxy relays on your machines without anyone choosing it. But for most organizations in the US or Europe, this is a “know your vendors” problem, not a direct threat.

For defenders, the priority is visibility. Know where your API calls are going, verify what model is actually responding, and treat any unofficial endpoint as a data exposure risk. The organizations that will be hit hardest are the ones that never checked.