An Inside Look at the Token Reseller Market

Re:An Inside Look at the Token Reseller Market by grinich on Sunday July 26, 2026 @02:35PM (#49060979)

This is the problem we've been working on solving with WorkOS Radar. We run it for Cursor and a bunch of other AI companies who have a free trial that gives some free inference to test the product.

It turns out to be a pretty complex program to solve at scale. Token fraud is a lucrative market and the adversaries are surprisingly sophisticated. It's a cat-and-mouse game, accelerated with AI.

https://workos.com/radar

(If you'd like to work on this, we are hiring :))

[ Parent | on HN ]

Re:An Inside Look at the Token Reseller Market by mlenhard on Sunday July 26, 2026 @02:49PM (#49061107)

I don't think device fingerprinting is the right approach here.

Client-side detection can always be sidestepped, and you need to intermediate the actual inference to get enough signals to make an accurate prediction. There are hundreds of listings for cursor tokens/credits right now.

We use canary values to detect the resellers, and I believe that's the only approach that will actually work at scale.

[ Parent | on HN ]

Re:An Inside Look at the Token Reseller Market by reliabilityguy on Sunday July 26, 2026 @09:20PM (#49064129)

> We use canary values to detect the resellers, and I believe that's the only approach that will actually work at scale.

Can you elaborate how it works? Specific sequence of tokens acts as a canary?

[ Parent | on HN ]

Re:An Inside Look at the Token Reseller Market by nikcub on Monday July 27, 2026 @02:14AM (#49065730)

sign up for the resellers, insert a random id canary into your requests, trace them back on your server to tie it to an account

find fingerprints / signatures of the accounts being used. ban all of them.

eventually build an ml based system that detects these at signup

reinforce with more data. loop forever, etc.

[ Parent | on HN ]

Re:An Inside Look at the Token Reseller Market by grinich on Tuesday July 28, 2026 @02:30AM (#49080147)

We do a lot more than device fingerprinting including training custom fraud models. We don't broadly publish our techniques for detection since that would make them much easier to circumvent.

[ Parent | on HN ]