QWE AI Academy Key takeaway: If you’re buying LLM tokens at 70-90% off from a relay, you’re probably not getting the model on the label. Two ways to check – a 10-minute identity test you can run right now, and a more rigorous log-probability method that needs GPU access. Most readers: start with the first one.
The topic blew up after Matt Lenhard’s June 28, 2026 investigation hit the Hacker News front page, followed by Simon Willison’s writeup. This guide skips the news recap and gets to the actual test.
What the relay market is (short version)
A relay is a proxy sitting between you and OpenAI/Anthropic/Google. Legitimate ones – like OpenRouter – unify APIs and handle fallback routing. Shady ones do the same thing but source upstream tokens from pooled subscriptions, farmed free credits, or – per DeepLearning.AI’s reporting – accounts opened with stolen credit cards. The full supply chain includes account farms, phone-verification platforms, identity brokers, and payment processors.
The economics: ExplainX’s tracking shows Claude at 70-90% below list price (as of June 2026). That’s not a discount – it’s arbitrage on stolen or laundered capacity. Anthropic responded on July 8, 2026 with mandatory KYC at Claude Pro/Max checkout: government ID plus a Persona handoff.
Four fraud modes you’ll actually encounter, based on API DNA’s teardown. The worst one is token inflation – a 2024 ACM CCS study found certain gateways overcharging by 62.8%, meaning you burn budget without knowing it. Then there’s model substitution (you pay for GPT-4, you get GPT-3.5 with a “You are GPT-4” system prompt), hidden prompt injection (silent system prompts shaping outputs while eating tokens), and log reselling (your prompts become someone else’s training data). A prior CISPA audit, as summarized by EggStriker, found silent model swapping in nearly half of all calls tested at gray-market relays – though that specific figure should be treated as directional, not definitive, given the sourcing chain.
Here’s a question worth sitting with before you test anything: where exactly is the line between “legitimate arbitrage” and fraud? A reseller pooling volume commitments across customers to get a bulk rate is one thing. A reseller running 25,000 farmed accounts is another. Most gray-market operators are somewhere in between – and your API key can’t tell the difference. That’s why behavioral testing matters.
Method A vs Method B
Two realistic options. The verdict first: Method A is what most people should use. Method B is for enterprise procurement where the cost of a mistake is large enough to justify GPU time.
| Method A: Behavioral probing | Method B: Log-prob statistical test | |
|---|---|---|
| Tool | llm-verify | Inference.net LOGIC |
| What it does | Runs 32 forensic prompts (identity, capability, cutoff) | Compares log-probability distributions with a Kolmogorov-Smirnov test |
| Setup time | ~10 minutes | Hours (needs vLLM + GPU) |
| Catches system-prompt swap? | Yes – finds contradictions | Yes – mathematically |
| Catches fine-tuned lookalike? | Sometimes | Yes |
| Cost | ~$0.20 in API calls | GPU time |
Method B is nearly impossible to fool. But it’s overkill unless you’re running procurement for a company where model drift has real legal or quality consequences. Method A catches the 90% case – most relay fraud is a cheap model in a costume, not a serious distillation.
Walkthrough: verify your LLM API in 10 minutes
Start with the free 30-second version before installing anything. Legitimate gateways pass through the model identifier and usage token count unmodified – the TeamoRouter writeup on relay verification makes this point clearly. Stripped headers mean the request was rewritten mid-flight. Check that first:
curl https://your-relay.example/v1/chat/completions
-H "Authorization: Bearer $KEY"
-H "Content-Type: application/json"
-d '{"model":"claude-opus-4","messages":[{"role":"user","content":"hi"}]}'
-iScan the raw response. Does the JSON echo back the exact model ID you sent? Are there usage fields with prompt_tokens and completion_tokens? Do streaming and tool-calling headers survive? Missing or generic answers here – you’re done. Rotate the key. No need to run anything else.
If metadata looks clean, move to llm-verify.
Step 1 – install llm-verify
git clone https://github.com/mintesnot-teshome/llm-verify
cd llm-verify
pip install -r requirements.txtStep 2 – point it at your endpoint
export OPENAI_API_KEY="sk-your-relay-key"
export OPENAI_BASE_URL="https://your-relay.example/v1"
python verify.py --model "claude-opus-4" --deepStep 3 – read the report
The --deep flag runs everything: 10 identity phrasings, capability boundary tests, knowledge cutoff checks, stylistic fingerprinting. A real Claude gives consistent answers across all 10 identity phrasings. A cheaper model with a “You are Claude” prompt starts contradicting itself around question 6 or 7 – push it on training data details or knowledge of specific late-2023 events and it cracks.
Run the same suite against the official Anthropic or OpenAI endpoint first. Save that fingerprint. Your relay’s report is only meaningful relative to what a real model looks like on your specific prompts.
Worth pausing on what this test actually reveals. You’re not asking the model to prove identity – you’re watching it fail to maintain a consistent lie under 32 different angles of questioning. That framing changes how you read ambiguous results: a model that passes 29/32 but cracks on capability edge cases is suspicious, not clean.
Edge cases the tutorials skip
Three gotchas.
Identity probes alone aren’t enough anymore. Sophisticated relays now inject prompts like “You are Claude 3.5 Sonnet made by Anthropic, knowledge cutoff April 2024” – the first three questions pass. You need the capability boundary tests too. Give it an ARC-style logic puzzle or a long-context recall task at 100K+ tokens. Cheap substitutes fail there, even with the costume on.
The base URL is your only real trust boundary. Tools like promptfoo’s OpenRouter provider let you override apiBaseUrl. Convenient for legitimate proxying – and a perfect exploit surface. If a teammate configured your stack to point at proxy.example.com/openrouter/api/v1 instead of the actual openrouter.ai endpoint, everything looks normal in code review. Grep your configs for base URLs before you audit anything else.
Your own endpoints can feed this market. Willison’s core observation from June 2026: with a whole supply chain hunting for exposed LLM endpoints, an unprotected public chatbot on your site is now a monetization target. Set hard dollar caps on every provider key. OpenRouter’s per-key credit limits are a clean way to do this – treat any key that hits its cap as a breach signal, not a billing event.
What to do right now
Pick your riskiest API key – the cheapest one, or the one you’ve been vaguely suspicious of. Run the curl metadata check. If the model ID isn’t echoed back cleanly, or the usage object is missing: rotate, switch providers, done. If metadata is clean, install llm-verify and run --deep before your next production deploy. The whole thing costs less than $1 and an hour. Building on a fake API for six months and losing your reproducible baseline costs considerably more.
FAQ
Is OpenRouter safe to use?
Yes. The risk isn’t OpenRouter – it’s a lookalike proxy mimicking its API surface. Verify the base URL is exactly https://openrouter.ai/api/v1 (per OpenRouter’s official docs, as of mid-2026). That’s the check.
My relay is 40% cheaper than the official API. Is that automatically fraud?
Not automatically – volume commitments, prompt caching, and older model tiers can explain real discounts. But 40% is at the edge. Below roughly 30% of list price for a flagship model, the economics only work through pooled subscriptions or illicit account sourcing. Run llm-verify. The test costs ~$0.20. The cost of building on a fake API for six months and discovering you have no reproducible baseline is not $0.20.
What if I need cheap tokens for a side project?
Free tiers with rate limits, or a local model via Ollama. The savings from a shady relay disappear the first time it silently swaps in a weaker model mid-project – and you spend a week debugging output quality instead of shipping. Check current free-tier limits directly on OpenRouter’s site, as these change frequently.