Inference Theft: How Hackers Profit From Vercel Through Residential Proxies

Inference theft is the stealing of expensive AI calls for resale. Attackers take tokens from startups, wrap them in their own API and resell them as a cheap alternative to OpenAI or Anthropic. Vercel has published a detailed report on an attack against its AI endpoints, which shows the economics of the thefts and why standard web defenses are completely ineffective.

Why AI calls are so expensive

An ordinary HTTP request costs roughly $2 per million requests, which is almost free. A single request to a frontier model (GPT-5.5, Claude 3.5 Sonnet) can cost $1-2. That is a million times more than a standard endpoint. For attackers the economics are ideal: steal a call worth $2 and resell it for $1.50, pure profit with no marginal inference cost.

How the theft works: the attack architecture

Attackers build an adapter, a software layer that turns someone else's endpoint into an OpenAI-compatible API. The victim pays for the inference; the attacker pays nothing. The process looks like this:

• They register thousands of throwaway accounts with the victim
• They buy residential proxy IPs in bulk (thousands of addresses)
• They wrap the stolen API in an adapter
• They offer it to their own customer base or resell it on the dark market
• They earn the difference between the stolen price and the resale price

A real example is Chipotlai Max, a fork of a coding agent that turns Chipotle's support chatbot into an OpenAI-compatible endpoint. The project openly seeks developers to do the same to Home Depot, Lowe's, Target and Starbucks.

Why rate limits and auth don't work

Rate limits and authentication were designed to defend against password brute-forcing and DDoS. There the calculation is that stealing a million passwords costs more than protecting them. With inference theft the math is reversed. Attackers simply buy residential proxy IPs individually, hundreds and thousands of addresses. A rate limit checked once per session gets spread across a thousand stolen calls rather than applying to each individual request. A real-looking account passes auth. By the time a request reaches your API, it has already crossed the boundary you planned to defend.

The real attack on Vercel

On April 12, 2026, traffic to the AI chat in Vercel's documentation grew 10x. At its peak it hit 1,300 requests per minute to Claude Haiku 4.5. That corresponded to a run rate of $10,000 in losses per hour. Attackers used residential proxies and fresh accounts to dilute rate limits.

How Vercel defends itself

Vercel routes every AI request through BotID, a deep analysis that runs not once per session but on every individual request. Instead of checking at the start, the check applies to every byte of data. You can deploy this on your own endpoints: a few lines of code block automated theft attempts.

What this means

If you have a public AI endpoint (playground, support, document AI), rate limits and auth no longer protect you. Defense must run at the request level, not the session level. For startups with open access this is critical: a single serious attack can cost tens of thousands of dollars in losses.