Protecting against token theft

Vercel charges ~$2/million, a fraction of a cent per call.

But a single prompt to an agent on a frontier model can cost $2, making AI a million times more expensive, and inference theft one of the highest-margin businesses an attacker can run.

We have seen this type of attack on our own APIs.

If you have AI endpoints exposed to the internet, the risk of abuse is high and can easily run up bills in the tens of thousands of dollars or more.

Protecting those endpoints requires verification to run on every AI request, not on the session or signup.

Rate limits and auth walls aren't sufficient on their own because checks that run once per session get amortized away across thousands of stolen calls.

At Vercel, we gate every AI request through BotID deep analysis, and you can do the same on your own endpoints with a few lines of code.

Copy link to heading What inference theft is Inference theft is the unauthorized use of someone else's paid AI inference, either for free consumption or downstream resale.

The operator pays per AI call; the attacker pays nothing for inference and then resells the tokens at a discount.

…