
@polydaici
Account based in
About this account
- Account based in
- West Asia
- Connected via
- North America App Store
Account-level information from X, not a live location or the device used for a specific post.
building @infertrail and memes. someone's using your llm keys and it's not you. i catch that.
Joined February 2014
- Tweets6.7K
- Following708
- Followers1.1K
- Likes698
Your inference may already be getting resold — and your logs can still look normal.
If you run an inference API, gateway, or AI product and you’ve seen suspicious credential sharing, resale, or unexplained usage, DM me. I’m looking to talk to teams seeing this in production.
There is a growing reseller market built around stolen API keys, shared subscriptions, proxy access, account farms, and piggybacked sessions.
The scary part: much of it can look completely legitimate from the provider side.
Valid credential. Valid account. Normal-looking requests.
Meanwhile, the same access can be passed through brokers, resold across borders, or quietly used by someone the account owner has never heard of.
Most LLM security products focus on what an agent is doing.
The blind spot is who is actually behind the account.
That’s what we’re building at @infertrail: behavioral detection for inference abuse, credential resale, and unauthorized access.
We’re publishing honeypot data, reseller-market research across Russian- and Chinese-language communities, attack patterns, and what we learn building detection for this problem.
Follow @infertrail for the research.
I’m never going to be able to afford SF now after this
Anthropic has filed an S-1 registration statement with the SEC related to its proposed IPO.
Read more: anthropic.com/news/s1-sec
Legal disclaimer: A registration statement relating to these securities has been filed with the SEC but has not yet become effective. These securities may not be sold, nor may offers to buy be accepted, prior to the time the registration statement becomes effective. This post does not constitute an offer to sell or the solicitation of an offer to buy these securities, nor shall there be any sale of these securities in any state or jurisdiction in which such offer, solicitation or sale would be unlawful prior to registration or qualification under the securities laws of any such state or jurisdiction.
we finally found out the real reasons the Pro tier was suspended. to beat Anthropic at Navier Stokes smh
Terence Tao says OpenAI went into CODE RED over rumors that Anthropic was close to solve a Millennium Prize Problem, and they paused new $200 Pro signups to direct compute to solve Navier-Strokes.
OpenAI rejected both claims.
but Tao’s timing is also very off about this:
>Sep 8: OpenAI published the results
>Sep 10: OpenAI paused $200 Pro
that’s TWO days after the announcement when they already finished solving Nav Strokes
Replying to @TheAhmadOsman
the more you roll your own the more you control but the more you have to defend on your own. its not a good solution for everyone
i used to be the person who explained why ai cost what it cost.
then i started seeing usage we couldn't explain.
since then i've seen people steal inference for personal use, for distillation, and for offensive security.
inference is valuable. someone pays for every request. steal access and someone else pays for yours.
but i think the appeal goes beyond free compute. using someone else's account puts distance between you and the activity. the account owner is visible. the person behind the requests can be harder to identify.
my research points to a billion dollars in lost revenue.
i've found sophisticated operations with their own payment systems, gateways, account theft operations and marketing. some have 100+ employees.
shell companies in the uk and the virgin islands. servers in russia and china. operators in the us and elsewhere. some advertise openly on x and other platforms. some have vc funding.
that's where trying to explain an ai bill took me: researching the businesses behind stolen inference.
who is actually using the inference you're paying for?
give me a follow if you want to learn how to secure yours. i'll share practical tips on protecting it from llm hacking, key theft, session theft, subscription piggybacking and more.
Replying to @blueemi99
reddit mods are the worst people in the world
Replying to @IndraVahan
My favorite is them mentioning the tourist tax like they are visiting a restaurant in Japan
Arielle retweeted
Replying to @polydaic
1/8 **CRITICAL SECURITY ADVISORY: CVE-1985-PING2SHELL**
**Severity:** Critical (CVSS 10.0)
**Affected Systems:** UNIX, Windows (all iterations dating back to 1985), and virtually every networked device since the dawn of TCP/IP.
Our incident response and threat intelligence
while you’re patching your s, check who’s using your API keys. i’m building Infertrail to detect stolen inference and credential abuse.
our website uses HTML so this is a difficult time for us too
infertrail.com

















