A few days ago I saw a screenshot on X of someone talking to what looks like a McDonald's support chatbot.
They wanted to order Chicken McNuggets, but before that they asked the bot to write a Python script to reverse a linked list.
The screenshot is probably fake, but that is not really the point.
Around the same time, in a Telegram group about bot development, someone asked who wanted to bet they could build a FunCAPTCHA solver with one prompt.
The bet was two chicken nuggets. Or one KFC chicken wing.
Maybe it is the same person. Or maybe bot developers just really like chicken nuggets.
I would not take the "one prompt" claim too seriously, but the screenshots still capture something we see much more seriously in bot development: LLMs have become part of the workflow.
If you spend time looking at bot tooling, reverse engineering projects, Telegram groups or Discord servers, you regularly see people using Claude, ChatGPT and other models for bypass development, code analysis, debugging and reverse engineering.
That should not be surprising. Most software engineers use these tools too.
What is more interesting is what happens when access to good models starts becoming useful enough that people are willing to automate, farm or resell that access.
The AI vs AI pitch is annoying, but not entirely wrong
If you work in cybersecurity, you have probably heard the same story hundreds of times: attackers have AI now, so defenders also need AI.
I do not like this narrative very much.
"AI" is a very convenient black box in security marketing. A vendor can say its model is better, sees patterns others miss, or adapts faster to new attacks. From the outside, most of these claims are hard to verify.
But I am not here to discuss how to evaluate cybersecurity vendors.
I also do not want to make broad claims about the whole security field. Most of what I see directly is related to bots, automation and anti-bot bypasses, so that is the part I can talk about.
And in that area, I do think AI helps attackers.
I do not have a clean number for how much more productive bot developers became after ChatGPT or Claude. What we see is more indirect: attacks hitting our customers, public tooling, and conversations in Telegram and Discord groups where bot developers share techniques, code and reverse engineering workflows.
My impression is that LLMs raised the floor for average developers and made skilled reverse engineers faster.
That does not mean every bypass is now one prompt away. It means some work that used to require more time, more manual analysis, or more specialized knowledge is getting easier.
AI is now part of the bot dev toolbox
One place where this is easy to see is reverse engineering.
A good example (among others) is Ghostwire, an open-source project that instruments JavaScript at runtime through CDP. It can expose things that are hard to recover with static analysis alone, like runtime-generated strings, evaluated code, worker execution, iframe execution or crypto inputs.
On its own, that is already useful tooling.
What makes it more interesting here is the AI integration. If Claude gets access to those runtime traces through MCP, it has much better context than if you simply paste a large blob of obfuscated JavaScript into a chat window.
It can reason over actual execution data, follow what happens at runtime, and use that information to understand parts of the anti-bot logic.
The interesting part for me is the workflow. Instead of manually digging through every runtime value, worker, iframe or generated string, you can expose that context to the model and let it help you navigate it.
It does not remove the need to understand what you are looking at, but it can save a lot of time during exploration and debugging.
For reverse engineering, that convenience matters.
Attackers want access to the good models too
This is the part I find more interesting.
If good models are useful for bot development and reverse engineering, then access to those models becomes useful too. And that access is not always cheap.
Over the last few weeks, my team has repeatedly come across infrastructure used to create and manage large numbers of accounts on AI platforms such as ChatGPT and Claude.
Some of these instances were simply exposed or badly secured, so it was fairly easy to understand what they were doing.
We also see more public tooling around the same problem.
One example is turb-gpt-free-register, an open-source project that automates ChatGPT/OpenAI account registration and Codex OAuth authorization. It supports protocol-level registration, fingerprint browsers, Playwright, cloud browsers and proxy-based flows.
I do not have a clean number showing how much this ecosystem has grown, but we come across this kind of tooling much more often than before.
And that is probably the interesting shift: once access to good models becomes useful enough, people start optimizing for the access itself too.
Why farm AI accounts?
The obvious reason is free usage. If an account comes with credits, a trial, or some included model usage, creating many accounts can turn that into a pool of cheap inference.
But the economics can go further than that.
This is a pretty concrete example of the resale model: create accounts, get API keys, put them behind another API, then sell access cheaper than the original provider.
The accounts do not even need to be free. Fraudulent payments can be used to fund them, with the provider eventually taking the loss through chargebacks.
There are other variations too. Accounts can be resold directly, used from countries where some AI products are not officially available, or automated through consumer subscriptions when that is cheaper than paying normal API rates.
You also see tooling built around using web access instead of API access. gpt-webcodex, for example, connects the web version of ChatGPT to a local development environment so it can read files, modify code and execute commands.
The exact scheme changes, but the incentive is the same: get access to useful model inference for less than it normally costs.
If tokens have value, people will find a way around the pricing
At this point, the economics are pretty simple.
If inference costs money, access to inference has value. Once that access is exposed through free trials, credits, subscriptions or API keys, people will try to get it cheaper than intended.
Patrick Collison, Stripe's CEO, put it pretty directly:
What I like about this tweet is that it removes a lot of the abstraction around "AI abuse".
The thing being targeted is compute.
Sometimes that means farming free accounts. Sometimes it means stolen cards, API keys or resale. Sometimes it means finding a cheaper path through a consumer product instead of paying normal API pricing.
Different schemes, same incentive: model usage has a direct cost, so access to it becomes something worth stealing or reselling.
Your AI feature can become someone else's API
You do not need to be OpenAI or Anthropic to run into this.
The same problem applies to any product that exposes useful model access, even if AI is only one feature inside a much bigger product.
OpenRouter is an obvious example. It gives access to many different models through one interface, and its credits map directly to inference. If someone can abuse accounts, payments or credits there, they are effectively getting model usage for less than intended.
AI coding products have similar incentives. Cursor, Codex-like products and other coding assistants expose strong models through subscriptions or bundled usage, which can make them interesting to automate instead of paying normal API rates.
But the broader case is regular SaaS products.
You may expose something narrow like document summaries, SQL generation, support answers or email writing. From your side, that is one feature with a specific use case. From the attacker side, it can still be access to a capable model.
If your product says "50 AI summaries per month", an attacker may simply read "50 model calls per account".
And if those calls are useful enough, some people will try to automate them, create accounts around them, or reuse the feature outside the workflow you designed.
AI access is becoming a fraud target
We spend a lot of time talking about how fraudsters use AI.
That is clearly happening in bot development. LLMs can help with code, debugging, reverse engineering and bypass development, and they can make skilled people faster.
What we are also starting to see more often is the other side of that: fraudsters are targeting the platforms that give them access to those models.
Sometimes the goal is free usage. Sometimes it is resale. Sometimes it is to get cheaper access than the normal API pricing. The exact scheme changes, but the reason is simple: inference has value.
And this is probably the part worth keeping in mind if you are building AI features into a product.
You may think about prompt security, jailbreaks or model behavior first. But if the feature gives users access to something that costs you money, you should also think about much more classic abuse problems: fake accounts, payment fraud, automation, account farming and resale.
Fraudsters use AI.
They also need access to it.
