There is a commercialised resale economy for AI inference credits operating largely outside the view of enterprise compliance teams, and it is bigger than anyone outside the startup world realises. Brokers buy surplus API credits from cash-strapped startups and resell them at discounts ranging from 30 to 80 per cent off list price. One broker told a researcher their account could spend $100,000 a day.
The discounts are not a pricing error. They are arbitrage on unused credits. Startups receive API credits through accelerator programmes, cloud provider partnerships, and promotional grants. When those credits exceed what the startup can use before they expire, the credits become a liability on the balance sheet and a liquid asset on the grey market. Brokers step in, buy at a fraction of face value, and resell at a markup that still undercuts the official provider rate.
What the Market Looks Like
The Vectoral research report documents several layers of this market. Credit marketplaces like AI Credits and AICreditMart let sellers list credits across major providers — OpenAI, Anthropic, Google, Azure, MiniMax, ElevenLabs — with discounts from 30 to 80 per cent. Bulk-discount routers like CheapCredits position themselves as achieving discounts through “bulk pricing,” though a flat 40 per cent off every model is difficult to explain through volume alone. Telegram channels, Reddit posts, and private startup forums carry the same inventory in less formal packaging.
The brokers do not typically hand over provider API keys. They operate as routing proxies, accepting customer requests and forwarding them through pools of API keys. The buyer never sees the original credentials. The trade-off is that the buyer’s data — every prompt, every response, every embedded credential or customer record — passes through an intermediary whose data handling practices, storage arrangements, and contractual relationship with the underlying provider are opaque.
Why This Is a Security Concern
The AI Governance Institute framed the risk plainly: any data sent through a broker proxy is processed under the broker’s contractual relationship with the AI provider, not the enterprise’s own data processing agreement. That silently voids data residency commitments, privacy protections, and audit rights that enterprises believed were in force.
The concern compounds because broker-routed API usage is invisible to standard enterprise controls. Cost allocation systems do not see it. Approved vendor registries do not include it. Shadow AI inventories do not track it. An engineering team that routes workloads through a discount broker to save money has effectively created an unmonitored data egress channel — one that compliance teams have no record of and no way to audit.
Provider terms of service universally prohibit credential sharing and resale. Any employee routing workloads through a broker is exposing the organisation to account suspension, retroactive usage audits, and potential liability for the broker’s conduct across the shared key pool.
The Bigger Picture
This is not just about brokers. It is a symptom of the broader token spending crisis that has been building through 2026 as enterprises discover that AI inference costs scale with usage in ways that traditional software never did. The pressure to cut costs is real, and when the official channels are expensive, the grey market fills the gap. The same dynamic plays out in every cost-pressured technology adoption cycle — from software piracy in the 2000s to shadow IT in the 2010s to shadow AI today.
What makes this different is the data dimension. Pirated software does not exfiltrate your customer database. A broker-routed API call might. Every prompt sent through an intermediary’s proxy is data leaving your perimeter through a channel you did not sanction, to a party you did not vet, under terms you did not agree to.
The Encryption Problem Layers On Top
The timing is uncomfortable. The same week the broker research circulated, The Hacker News reported on a separate vulnerability in how OpenAI, Anthropic, and Google carry hidden reasoning between API calls. Researchers decoded 315,320 thinking blocks from 6,708 public agent trajectories and recovered 704 privacy artifacts, including 62 API keys, 33 passwords, and 24 access tokens. The two stories are unrelated, but they converge on the same question: when your data passes through opaque intermediaries — whether a broker proxy or an encrypted reasoning block — who actually has access to it?
❓ FAQ
How do AI credit brokers get their supply? Most credits come from startups that received API credits through accelerator programmes like YC Startup School, cloud provider partnerships, or promotional grants. When startups cannot use the credits before expiry, they sell them at a discount rather than let them expire worthless.
Is using a credit broker against provider terms? It violates the terms of service of every major AI provider. The legal status depends on jurisdiction and the specific arrangement. The more immediate risk for enterprises is account suspension and the loss of data protections under their own provider agreements.
Can enterprises detect if their teams are using brokers? Not easily. Broker-routed API calls look like normal API traffic from the application side. The signal is in procurement — discounted API purchases outside the approved vendor list, credits bought at non-standard rates, or API spending that does not match the official provider’s billing.
Why would an engineering team use a broker? Cost. A 40 per cent discount on inference is a meaningful saving for a team burning through tokens at scale. The security trade-off is often invisible because the team may not realise the broker proxy changes the data processing relationship.
🔍 THE BOTTOM LINE
The token resale economy is a structural consequence of AI inference pricing meeting startup credit oversupply. The discounts are real, the market is liquid, and the compliance gap is genuine. Any organisation using AI APIs should treat broker-routed access as an unmonitored data egress channel — because that is exactly what it is.
