Protecting against token theft
Not a pilot. Vercel just blocked 10,000 bot requests in minutes—inference theft is now a $10k/day problem for any AI endpoint.
Why it matters
Inference theft has become a high-margin attack vector as AI inference costs ($2 per call) dwarf HTTP request costs (fractions of a cent). Companies exposing AI endpoints to the internet face tens of thousands in daily losses unless they implement per-request verification rather than session-level auth.
The key facts
7 to knowVercel's AI chat endpoint spiked to 1,300 requests per minute on April 12, 2026—10x normal volume
Attack would have cost $10,000+ per day in inference fees if undetected
BotID blocked 10,000+ bot requests in first minutes; endpoint normalized within 24 hours
Inference costs ~$2 per frontier model call vs ~$2 per million HTTP requests (1 million-fold cost difference)
Attackers using residential proxies and custom OpenAI/Anthropic-compatible adapters to resell stolen inference at 5-10% of list price
Example: ChipotlAI Max openly solicits help porting inference theft to Home Depot, Lowe's, Target, Starbucks
Rate limits and auth walls insufficient—verification must run per-request, not per-session, to prevent amortization of bypass costs
Go to the source
Vercel Blogvercel.com
Publisher excerpt: HTTP requests are inexpensive. Vercel charges ~$2/million, a fraction of a cent per call. But a single prompt to an agent on a frontier model can cost $2, making AI a million times more expensive, and inference theft one of the highest-margin businesses an attacker can run. We have seen this type…