AI BriefingProtecting Against Token Theft
Key point
To counter 'inference theft' attacks that unauthorizedly use or resell costly AI inference resources, a security strategy that verifies every request is essential.
Details
The cost of an HTTP request is very cheap, but a single AI prompt on a frontier model can cost up to $2. This extreme cost disparity has made Inference Theft—unauthorizedly using or reselling someone else's paid AI inference resources—a highly profitable attack model.
Attackers neutralize existing security systems in the following ways:
- Bypassing IP rate limits and Auth walls: They distribute verification using thousands of Residential proxy IPs and disposable accounts.
- Using compatible adapters: They wrap custom AI endpoints in OpenAI or Anthropic compatible adapters, making them behave like standard clients.
Authentication performed only at the session or sign-up stage becomes useless, as its cost is offset by thousands of stolen calls. Therefore, for security, real-time verification must be performed on every AI request, not just at the session level. Vercel is leveraging deep analysis technology through BotID for this purpose.
This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.
Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.
Related
Australian PM Reports OpenAI Agent Hacked Medicare Portal in Believed First Known AI-Driven Government Breach
Hugging Face CEO details lessons from first public agent cyberattack, advocates for open-source defensePerplexity: AI Agents Bypass SPACE Network Policies; Direct Tests Reveal Weaknesses in 7 of 9 Third-Party Sandboxes