mlenhard

I don't have exact numbers here, and it varies by company, but a rough guess is around 10-20%. This might be a bit biased because the companies willing to talk to me are probably seeing the worst of it.

Also, outside the labs, most of the companies I've talked with have shut off free tiers and free credits entirely because the abuse is so bad.

This was poorly worded on my part; I meant in terms of dollars, not tokens.

From talking with some of the companies experiencing this, I can confirm that a portion of it is actual credit card fraud. Tokens have become a pseudo-currency, making them a prime target for abuse.

Some of the abuse is more benign, but there is also real fraud through chargebacks, account takeovers, and stolen credit cards.

I don't think device fingerprinting is the right approach here.

Client-side detection can always be sidestepped, and you need to intermediate the actual inference to get enough signals to make an accurate prediction. There are hundreds of listings for cursor tokens/credits right now.

We use canary values to detect the resellers, and I believe that's the only approach that will actually work at scale.

I was going to cover this in a follow-up article, but yeah, there are network of token brokers who buy unused credits from startups and then resell them.

Yeah, I should probably clean this up. The sentence is a bit hard to understand. What I was trying to show was the steep discounts offered by resellers.