The economics of stolen inference

An HTTP request costs fractions of a cent at typical cloud pricing. An API call to a frontier-model agent can cost $2. That spread makes AI inference one of the most profitable resources to steal: an attacker who gates your endpoint once and then resells unlimited inference at a five-to-ten percent discount off list price runs a near-zero-cost business on your bill.

Any AI endpoint reachable over the internet is at risk. The danger scales with how much control the caller has over the prompt. AI playgrounds are the most exposed shape, since the caller controls the model, the prompt, and usually the parameters. Support bots and documentation assistants sit lower on the risk curve when system prompts are locked server-side, but attackers have learned to steer those chat systems into useful outputs cheaply enough to make resale viable.

Resale value tracks how cleanly stolen calls drop into standard tooling. For that reason, sophisticated attackers wrap the victim's API in an OpenAI- or Anthropic-compatible adapter. That adapter is a one-time engineering cost that makes the stolen inference usable from any standard coding agent or SDK. A real example is Chipotlai Max, a forked agent that ships a proxy converting Chipotle's support chatbot into an OpenAI-compatible endpoint, with open solicitations for porting the trick to other retailers. The adapter also becomes the auth boundary for downstream buyers: they authenticate to the proxy, not to your origin. By the time a request reaches your API, the session gate you planned has already been bypassed.

Why traditional web defenses fail

Rate limits and authentication were built for attacks with different economics. When per-request value is low, attackers abandon IP-rotation and fake-account strategies once they cost more than the payloa. Stolen inference flips that balance. An attacker is willing to buy residential proxy IPs by the thousands and register accounts at any scale, because a single bypass yields hundreds of thousands of high-value calls.

We know this pattern first-hand. On April 12, 2026, traffic to the Vercel docs AI chat spiked to roughly ten times normal volume on Anthropic's Claude Haiku 4.5 model. Requests peaked at 1,300 per minute, putting the endpoint on an inference cost run rate north of ten thousand dollars per day. The traffic originated from residential proxies, obscuring client IPs and rendering standard per-IP limits useless across the hundreds of thousands of requests that followed.

The takeaway is structural: any gate executed once per session amortizes the attacker's bypass cost across every stolen call. Verification must run on each AI request, not on signup or session start.

Gating every request without a visible challenge

Traditional image CAPTCHAs are no longer sufficient. The same class of models that makes inference valuable can defeat them, and a visible challenge interrupts the user experience. Instead, we gate our AI endpoints with Vercel BotID, which uses Kasada-powered client-side machine learning to classify humans against bots invisibly. Because it presents no challenge, it runs per request without user friction.

Server-side, the check happens inside the route handler with checkBotId(), which returns a classification for the request currently being served:

// app/api/ai-chat/route.ts
import { checkBotId } from 'botid/server';
import { NextRequest, NextResponse } from 'next/server';
export async function POST(request: NextRequest) {
  const verification = await checkBotId();
  if (verification.isBot) {
    return NextResponse.json({ error: 'Access denied' }, { status: 403 });
  }
  // Your existing AI SDK call path
}

Two configuration requirements matter in practice. First, the route must be declared on the client as well; otherwise, BotID never attaches the challenge headers the check relies on:

// instrumentation-client.ts
import { initBotId } from 'botid/client/core';
initBotId({
  protect: [{ path: '/api/ai-chat', method: 'POST' }],
});

Second, the next.config.ts wrapper described in the BotID docs is mandatory for the setup to function end-to-end.

That per-request gate stopped the attack on our endpoint within minutes. BotID deep analysis identified and blocked more than ten thousand bot requests in the opening burst; within twenty-four hours, request volume on the endpoint was flat at baseline.

What to protect first

Inference will remain orders of magnitude more expensive than the request envelope carrying it, and resale will therefore stay profitable for attackers. Defenders control only their own exposure. On that front, the immediate steps are:

  • Audit which AI endpoints sit on the public internet.
  • Rank them by caller prompt control, since more control means easier resale.
  • Apply per-request verification to the highest-risk endpoints first.

The cost asymmetry favors the defender: defeating per-request verification on every call is expensive, while the verification itself is the cheapest part of the request lifecycle.