I expect most of the use to be for bulk data processing or desperate founders who don't care, not for agentic coding use at promising startups.
If your startup needs to run a million records of something, especially public data, through an LLM to extract the data you need, using bootleg tokens to shrink the bill starts feeling tempting.
If you're concerned about the data leaking, the biggest risk is that the API backends are quietly routing your requests to a cheaper model. You might be trying to buy Opus tokens but get Deepseek Flash responses.
> to run a million records of something, especially public data, through an LLM to extract the data you need
Maybe this make sense, but anyway I have to pay a lot of attention at the output I get. Eg: who guarantees there is no prompt/sql injection? Especially if I have to load the output in some internal system.
Bulk data processing typically has structured JSON output.
I mean someone could try to sneak prompt injection into a text field, but the people buying black market resale tokens from third parties aren’t thinking about anything other than getting cheap output.