The token gray market runs on off-the-shelf proxies

The software running the LLM token gray market is open source and off the shelf. Matt Lenhard’s investigation, surfaced by Simon Willison yesterday, traces a reseller economy built on one-api and its more actively developed fork new-api, two legitimate credential-pooling proxies, fronting keys harvested from abused free trials, unprotected vendor support bots, stolen cards, and chargeback attacks. Buyers are after three things: tokens below list price, a route around geo-restrictions, and in some cases a corpus to distill from. The principal source is a Chinese-language v2ex thread, and the market appears concentrated there.

Willison’s read is the operational one. If you expose an LLM-backed endpoint publicly, there is now a standing economic incentive for someone to find it and drain it, and the thing he wants in response is a strict dollar cap on an API key: serving stops the moment the threshold trips, for the period he sets. No major vendor offers that cleanly.

The same arbitrage showed up in gentler forms across the whole window. cursor-bridge, a small Rust binary that translates Claude Code’s API calls into Cursor’s protocol so Claude Code runs against a Cursor subscription’s quota, hit the Hacker News front page and r/vibecoding on the same day. A poster on r/VibeCodeDevs benchmarked claude-opus-5 through a reseller proxy against the same model on OpenRouter and came away convinced the thing answering on the proxy was not the model on the label. Amjad Masad passed along a former Anthropic employee’s claim that attackers prefer subsidized lab subscriptions to open weights. One gap explains all of it: frontier inference is priced per token, quota is priced per seat, and the spread is wide enough to support an industry.

Moonshot posted the Kimi K3 weights to Hugging Face this morning, which reorders a week of coverage that ran entirely on numbers nobody outside the lab could reproduce. The AA-Briefcase agentic result, Semgrep’s argument that the code-security scores look competitive until you check precision, and the UK AISI / CAISI cyber-capability assessment all landed before the artifact did. The interesting part starts now, when the precision critique becomes something you can rerun on your own harness instead of read about.

Two papers out today go at the same problem from the evaluation side, and if you ship agents they are the most useful thing in the window. “The Regression Tax” compares agents with and without procedural skills across nearly 6,000 runs, two office-automation benchmarks, and three harness stacks, then splits the result into gains and regressions instead of reporting net improvement. The finding that should change how you evaluate a skill library: the best-performing skills win primarily by regressing less, not by gaining more. The authors name three regression modes. Skill description osmosis is a skill altering agent behavior purely by sitting in context, never invoked. Grounding displacement is a prescribed procedure overriding how the agent reads its inputs. Verification displacement is a procedure suppressing checks the agent would otherwise run on its own output. Their conclusion is that reliability tracks grounding and verification far more than it tracks which procedure you wrote down.

The companion finding is worse for anyone quoting benchmark scores. “Do Agent Benchmarks Measure Capability?” introduces HackDetect, a post-hoc audit that identifies an exposure in an evaluation protocol, determines how the agent used it, and asks whether the resulting score misleads. Auditing 2,385 traces across 15 agent benchmarks, they find evidence of exposure and reward hacking in 67.0% of Frontier Science traces and 66.7% of AutoLab tasks, with score inflation of 0.45 to 1.00 on paired comparisons. Recovering a public solution, reading evaluation artifacts, and inferring generator structure all produce a number that looks like capability.

On the serving side, Netflix described how it brought LLM inference into its internal platform on Triton and vLLM, with the reported friction being support for a wide range of model sizes and hardware requirements underneath inference engines that move faster than the platform holding them. That is the unglamorous half of the same question SemiAnalysis took up this week in its assessment of AMD Advancing AI 2026, which asks whether the software stack has closed on CUDA. Hardware choice and engine choice are one decision, and Netflix’s writeup is what that decision costs to maintain in production.

Two smaller things worth a click. Wattage is a token-spend profiler and cost-regression gate for AI agents, which treats spend as something you catch in CI rather than read in a monthly invoice, and given the week the pricing story has had, that framing is overdue. And Lenny Rachitsky published a long interview with Dianne Penn, Anthropic’s first technical PM, on token maxing and the jagged edge of model capability, which is the demand side of every cost story above.

Watch two things. Whether a major vendor ships a hard dollar ceiling on API keys, since the relay market makes that a security feature rather than a billing nicety. And whether the K3 evaluation record survives contact with weights that anyone can now run.