In October 2026 The Information reported that businesses in a single Beijing office building were reselling access to Anthropic's Claude models at 70 to 90 percent below list price, routing Chinese developers' requests through overseas accounts. The report is paywalled and those figures are reported, not verified by us. What can be verified is the supply side: Anthropic itself described, in February 2026, "commercial proxy services which resell access to Claude and other frontier AI models at scale" as one of the ways its regional restrictions were being evaded.
The buyer's question is simpler than the geopolitics. If a service that is not Anthropic or OpenAI offers you their models at a fraction of the price, what are you actually buying, what does the vendor's contract say about it, and is there an honest way to get a similar bill? This post answers all three, then gives a checklist to run before any purchase from a third party.
Two boundaries. No reseller is named here, and no allegation is made against any company beyond what the vendor or the reseller has itself published. And the numbers in the legitimate-discount section are list prices read from the vendors' pricing pages on October 9, 2026, which can change. The context for the vendor-side enforcement is in our coverage of Anthropic's February distillation report and the June Alibaba allegation.
- 01There is no wholesale tier to pass on.Neither Anthropic nor OpenAI publishes a reseller price list for its API. The published discounts are batch processing at 50% and cache hits at 10% of input price. A 90% discount has to come from somewhere other than the vendor.
- 02Both vendors' terms forbid the arrangement.Anthropic's consumer terms bar sharing an API key or reselling the service; its commercial terms allow resale only where expressly approved. OpenAI's services agreement says a customer may not resell or lease account access, and may not buy, sell or transfer API keys with a third party.
- 03The reported risks are substitution, logging and loss.Coverage of the resale market describes cheaper or domestic models served under a Claude label, prompts and outputs retained by the intermediary, and accounts that vanish when the vendor bans the farmed supply. All three are reported, and all three are consistent with how the supply works.
- 04The honest discount is large, just not 90%.Switching a workload from Opus 5 to Sonnet 5.5 cuts the bill by 60% at list price; adding batch halves it again; caching a stable prefix cuts the cached input cost to a tenth or less. In the worked example, a $1,000 workload reaches $200 to $100 with no contract breach.
- 05Run the checklist before paying anyone but the vendor.Who holds the account, where it is billed, whether the model is verifiable, where your prompts go, and what happens when the supply is cut. A disclosed router that bills you for the vendor's list price answers all five; a discount reseller answers none.
01 — The MarketWhat has been reported, and by whom.
The Information's October report describes what it calls transfer stations: businesses that accept a prompt from a developer in China, forward it to Claude through an account held abroad, and bill in renminbi. The discounts it reports range from 70 to 90 percent below Anthropic's list. Secondary coverage of the same report adds that the supply comes from farmed free credits, subscriptions split across many users, and accounts opened with purchased card details. We could not read the original and treat every figure here as reported.
The vendor-side account is not reported; it is Anthropic's own. In its February 23, 2026 post on distillation attacks, Anthropic said three laboratories had "generated over 16 million exchanges with Claude through approximately 24,000 fraudulent accounts", relying on "fraudulent accounts and proxy services to access Claude at scale while evading detection". The same post describes commercial proxy services that resell Claude access as a route around its China restrictions. That is the supply chain a discount reseller sits inside, whether or not any individual reseller is part of a distillation effort.
The point for a buyer outside China is that the same machinery serves anyone. A reseller that can route a Beijing developer's traffic can route yours, and the risks that come with the account behind it come with it.
02 — Delivery RiskWhat a buyer may actually receive.
Four things can go wrong, and each follows from how the discount is produced rather than from any particular seller's intent. The first is substitution. A reseller controls the endpoint you call, so the model that answers is whatever the reseller chooses to run. Coverage of the resale market reports buyers paying for a flagship model and receiving a cheaper tier or a domestic model relabelled. An API response carries a model field, but that field is written by whoever operates the proxy.
The second is logging. Every request passes through the reseller's infrastructure in plaintext, because it must be re-sent to the vendor. Reports describe prompts, outputs and code context being retained. Whether any given reseller does this is unknown; that it can is certain, and a contract with an unidentified counterparty offers no remedy.
The third is loss. The supply is accounts the vendor will ban when it finds them. Anthropic's February post describes detecting networks of fraudulent accounts that spread traffic across its API; a buyer whose traffic ran through one loses access with no notice, and any prepaid balance with it.
The fourth is attribution. Vendors investigate abuse by traffic pattern. A buyer whose prompts travelled through a farmed account cannot show the vendor a clean history, and a later legitimate application may inherit the suspicion.
| Risk | Why it follows from the discount | How you would notice | Who bears it |
|---|---|---|---|
| Model substitution | The reseller owns the endpoint; serving a cheaper model is the easiest way to widen the margin | Quality drift on tasks the model used to handle; answers to model-identity questions that do not match the vendor's | You, in output quality |
| Prompt and output logging | Requests are re-sent to the vendor from the reseller's servers, so the reseller sees everything | Usually never; there is no audit right against an unidentified counterparty | You and your customers, under your own privacy obligations |
| Sudden loss of access | The underlying accounts are ones the vendor bans when found | Errors from one hour to the next; a reseller that goes quiet | You, in downtime and prepaid balance |
| Contract and attribution | Both vendors' terms forbid resale and key transfer; your traffic shares a history with abuse | A later direct application declined or flagged | Your business, later |
03 — ContractWhat the vendors' terms say.
Both vendors address the arrangement directly, in documents dated before this post. Anthropic's consumer terms, effective October 8, 2025, say: "You may not share your Account login information, Anthropic API key, or Account credentials with anyone else." They bar use of the consumer service to "resell the Services" and state that "you will not use our Services for any commercial or business purposes". The commercial terms, effective June 17, 2025, say a customer may not "resell the Services except as expressly approved by Anthropic" and may not access them "to build a competing product or service", including to train competing models.
OpenAI's services agreement, effective January 1, 2026, is more specific still. Section 3.1 says a customer "will not share Account access credentials or individual login credentials between multiple users" and "may not resell or lease access to its Account or any End User Account". Section 3.3 lists what a customer will not do, including "buy, sell, or transfer API keys from, to, or with a third party" and "circumvent any rate limits or restrictions". The consumer terms of use, same date, say "You may not share your account credentials or make your account available to anyone else."
So a discount reseller that is not an approved partner is in breach on the supply side by construction. The buyer's exposure is narrower but real: the buyer is using an account it is not party to, through a key it did not receive from the vendor, which the agreement says cannot be transferred.
| Clause | Anthropic | OpenAI | For a buyer |
|---|---|---|---|
| Resale | Consumer: may not "resell the Services". Commercial: not "except as expressly approved by Anthropic" | "Customer may not resell or lease access to its Account or any End User Account" (Services Agreement §3.1) | Ask for proof of an approved partner or reseller agreement |
| Credential and key sharing | "You may not share your Account login information, Anthropic API key, or Account credentials with anyone else" | Will not "buy, sell, or transfer API keys from, to, or with a third party" (§3.3) | A key you did not get from the vendor is a transferred key |
| Commercial use of consumer plans | "You will not use our Services for any commercial or business purposes" (consumer terms) | Consumer terms: may not "make your account available to anyone else" | A split subscription is a consumer plan used commercially by strangers |
| Limits and safeguards | Consumer terms bar "bypassing any of our systems or protective measures" | Will not "circumvent any rate limits or restrictions" (§3.3) | Pooling many accounts to beat a limit is the business model |
04 — GeographyThe region rules a reseller exists to get around.
The transfer-station market exists because the vendors do not serve every country, and the restriction is written into the terms rather than left to IP blocking. Anthropic's supported-countries page says its products and services "are available only in the countries and regions listed", and its list of unsupported cases includes "use by persons while physically located in an unsupported region" and "use by entities incorporated or headquartered in an unsupported region". The commercial terms point to the same policy and add an export-control clause.
OpenAI's help-centre list of supported countries for the API makes the consequence explicit: "Accessing or offering access to our services outside of the countries and territories listed below may result in your account being blocked or suspended." Offering access, not only using it. A reseller whose customers sit in an unsupported region is offering access there, and the account doing the offering is the one that gets suspended, with every buyer's traffic on it.
For a buyer in a supported country, the region rule still matters in one way: it is the reason the supply is unstable. The accounts you are sharing were opened to serve people the vendor has said it will not serve, and the vendor is actively looking for them.
05 — Honest DiscountsThe ways to pay less that the vendors publish.
The reason a reseller's pitch lands is that the list price for a flagship model is high and most buyers have never priced the alternatives the vendor itself offers. There are five, and they stack.
Batch processing is the largest single lever. Anthropic's pricing page says its Batch API offers "a 50% discount on both input and output tokens" for asynchronous work; OpenAI's batch guide says "50% cost discount compared to synchronous APIs" with each batch completing "within 24 hours (and often more quickly)". Anything that does not need an answer in seconds, which is most back-office work, qualifies.
Prompt caching is the second. On most current Claude models a cache hit costs 10% of the base input price, 5% on Opus 5.5 and Sonnet 5.5, and 2.5% on Fable 5.1; the page says the cache multipliers "stack with other pricing modifiers, including the Batch API discount". A long system prompt or a document that every request re-reads is the ideal case.
Model choice is the third and often the biggest. At list, Opus 5 is $5 per million input tokens and $25 output; Sonnet 5.5 is $2 and $10; Haiku 4.5 is $1 and $5. Many tasks a flagship handles well, a smaller model handles adequately, and the test is cheap to run on your own traffic. The fourth is buying through an official cloud marketplace, where the vendor's models are sold under the cloud provider's contract and billing, which some finance teams prefer. The fifth is a disclosed router such as OpenRouter: it names the model, bills you at or near the vendor's list price, and does not pretend to a discount it does not have. It solves a procurement problem, not a price one.
Off input and output, both vendors
Anthropic: a 50% discount on both input and output tokens for asynchronous requests. OpenAI: 50% versus synchronous APIs, completed within 24 hours and often faster, with separate rate limits.
Of base input price on most Claude models
A 5-minute cache write costs 1.25× input and a hit costs 0.1×, so caching pays after one read. Opus 5.5 and Sonnet 5.5 charge 5% on hits; Fable 5.1 charges 2.5%. Multipliers stack with batch.
Haiku 4.5 against Opus 5 at $5 / $25
A five-fold difference at list before any other lever. Sonnet 5.5 sits between at $2 / $10. Test on your own traffic before switching; the saving is only real where quality holds.
Named model, vendor list price, one invoice
A router that bills at list and names the model solves multi-vendor procurement and failover. It is not a discount and does not claim one, which is the point.
06 — ArithmeticA worked cost example.
Take a workload of 100 million input tokens and 20 million output tokens a month, which is a mid-sized document-processing or support-summarisation pipeline. Prices are Anthropic's list prices as read on October 9, 2026, in US dollars per million tokens. The reseller row applies the reported 80% discount to the Opus 5 list bill, in the middle of the reported range, and assumes the model served really is Opus 5, which section 02 says a buyer cannot verify.
| Route | Input cost | Output cost | Monthly total |
|---|---|---|---|
| Opus 5, direct, list | 100 × $5 = $500 | 20 × $25 = $500 | $1,000 |
| Reseller at a reported 80% off (unverifiable model) | — | — | $200 |
| Opus 5, direct, batch | 100 × $2.50 = $250 | 20 × $12.50 = $250 | $500 |
| Opus 5, direct, 70% of input as cache hits | 30 × $5 + 70 × $0.50 = $185 | $500 | $685 plus cache writes |
| Sonnet 5.5, direct, list | 100 × $2 = $200 | 20 × $10 = $200 | $400 |
| Sonnet 5.5, direct, batch | 100 × $1 = $100 | 20 × $5 = $100 | $200 |
| Haiku 4.5, direct, list | 100 × $1 = $100 | 20 × $5 = $100 | $200 |
| Haiku 4.5, direct, batch | $50 | $50 | $100 |
Read the two $200 rows against each other. Sonnet 5.5 through the vendor's batch API costs the same as the reported reseller price for Opus 5, with the model named on the invoice, your prompts seen only by the vendor, and no account that can be banned out from under you. Haiku 4.5 on batch is half that again. Whether the smaller model is good enough is a question you can answer with a week's test on real traffic; whether the reseller is really serving Opus 5 is a question you cannot answer at all.
The failure case is the workload that genuinely needs the flagship in real time, where no lever applies. For that buyer the honest price is the list price, and the right place to cut is volume, through the spend controls every vendor now offers, not through a counterparty who cannot say where the tokens come from.
07 — Due DiligenceThe checklist before you pay.
Six questions, each with the answer a legitimate counterparty can give and the answer a discount reseller cannot. Ask them in writing and keep the replies.
08 — RemediationIf you have already bought.
Some teams will read this having already routed production traffic through a cheap endpoint a developer found. The exposure is the same four risks from section 02, and the fix is a migration, not a confession. Three steps, in order.
Open the direct account first
Create the direct account, set usage limits and alerts before any traffic moves, and run the worked-example arithmetic on your real token counts. Most teams find the honest bill with batch and a smaller model is close to what they were paying.
Rotate everything that passed through
Assume every prompt the intermediary saw was logged. Rotate API keys and any secrets that appeared in prompts or tool calls, and review what customer data went through under your own privacy obligations.
Cut over and keep the evidence
Move traffic to the direct account, record when the reseller was used and for what, and stop prepaying. If a later vendor review asks about traffic patterns, a dated migration record is the answer a clean history would have given.
For a wider view of what a model buyer should check after the US agencies' distillation advisory, including provenance questions that apply to any intermediary, see our note on what the distillation advisory means for buyers. If you want help sizing the honest bill for a workload and choosing the model and route that meet it, that is part of what our AI transformation engagements cover.
09 — ConclusionThe discount is real; the product is not.
Price the vendor's own levers first, test a smaller model on real traffic, and buy only from a counterparty who can name the account, the model and the data terms in writing.
The reported resale market exists because the vendors exclude some regions and price flagship models high, and it runs on accounts opened against the vendors' terms: shared credentials, split consumer subscriptions, transferred keys. Both Anthropic's and OpenAI's contracts forbid each of those in plain words, and OpenAI's supported-countries page says that offering access outside its list can get the account suspended.
A buyer anywhere who uses that supply inherits its instability and gives up three things the vendor relationship provides: knowing which model answers, knowing who sees the prompts, and a contract to enforce when either goes wrong. In exchange for a reported 70 to 90 percent off a list price that the vendor's own batch, caching and model-choice levers can already halve, and halve again.
Run the six questions. If the counterparty is the vendor, a cloud marketplace, an approved partner, or a router that bills at list and names the model, the answers come easily. If they do not, the price was never the product.