How a Chinese-language red-team swarm farms free LLM tokens

One resale gateway's eleven-minute burst on our free tier was 62% one security-testing swarm. It is written in Chinese, runs itself, and hunts the thing it runs on: free model capacity. Here is how it works, what it hunts, and what to close.

How this started

It started when we noticed a large botnet mass-signing up to our service, superbot.gg, to resell its tokens through a 9Router Pro instance. 9Router is an open-source router that pools many providers' model keys behind one address. 9Router Pro is a fork that adds per-key personas and token quotas. Figure 1 shows what that gateway's customers ran in one burst, and the biggest was the swarm.

scroll sideways for the rest

How the swarm is built

A red team attacks a system on purpose so its owner can fix it. This swarm is a red-team product with no person at the keyboard. A planner reads a shared graph of findings and assets and hands out tasks. Each task is called an intent. A worker gets one intent and its own request budget, proves it or drops it, writes back what it saw, and stops. A digest sums up one part of the graph for the planner. A report writer turns each confirmed flaw into a fix-it report, in Chinese.

The worker's instructions open like this:

你是一个网络安全平台授权渗透测试系统的"执行者"(work agent)。你领到【一条意图】(一句话探索方向)，唯一职责：完成这一条意图、把发现写回知识图谱、然后停止返回。

You are the "executor" of a cybersecurity platform's authorized penetration-testing system. You are handed one intent, a one-sentence direction to explore. Your only job: finish that intent, write what you found back to the knowledge graph, then stop.

Its tools say the same: report_finding, record_fact, insert_assets. A worker carries 29 tools, and about ten of them belong to the product. Behind a tool search sits a kit of roughly two hundred reverse-engineering tools, such as decompilers and packet and firmware inspectors. So it is more than a web scanner.

The planner only plans. It never does the work itself, and it has one hard rule:

只要【目标未达成】且【当前没有任何 open 或 running 意图】…本轮就【必须】产出至少一个向目标推进的意图…

As long as the goal is unmet and nothing is open or running … this round must produce at least one intent that moves the goal forward …

So the queue never empties and the swarm never idles. In that burst it ran 2,686 conversations on farmed free keys, and 97% of its task text was Chinese. Figure 2 shows where its requests went.

scroll sideways for the rest

Its rules of engagement

Each intent reads like a bug ticket. It names the lead that prompted it, the test accounts the worker may use, the check to run and the result that closes it. The budget sits in the same line:

只动自有 A/B、≥1s、≤25 请求

Touch only our own two accounts, at least a second apart, at most 25 requests.

That one line sets the scope, paces the traffic and caps what a failure can cost. The swarm tests with accounts it made itself. A write that crosses from one customer's data into another's counts as a finding. A list it could read counts as a minor note. A run of refusals closes the line with nothing.

The bar for evidence is strict. A CVE (Common Vulnerabilities and Exposures) is a public catalogue entry for a known flaw. A worker may not count a match to one as a finding:

只有你本次真实触发过、拿到可复现证据（请求/响应或命令输出）才用…严禁把“版本/指纹匹配到 CVE”“参数看起来可注入”…当已确认

Use it only if you triggered it this time and hold reproducible evidence, a request and response or command output. Never count a version match to a CVE, or a parameter that looks injectable, as confirmed.

So the report writer only sees flaws the swarm has shown for itself. Its brief asks for a report that is reproducible and says how to fix the flaw.

What it hunts

Its targets are ordinary software businesses. They run platforms with accounts, memberships and credits behind a web application programming interface (API). The swarm worked a queue of them at once, from one gateway key. Across the burst, its stated goals were:

• admin access, or a way into the database behind an app;
• other vendors' upstream model keys, proved live with a call and priced by tier and balance;
• unlimited registration, so a new account is never the bottleneck;
• a way around bans and rate limits;
• unlimited membership upgrades and credit;
• wallet private keys and seed phrases;
• captcha solving;
• usable API keys in bulk.

The one intent we can read in full is a missing check between one customer's account and another's. It sits at a vendor we do not name, and as far as we know it is still open. The swarm never named us in any prompt we captured.

Model capacity is the goal closest to home. FOFA is a search engine that finds internet-facing services by fingerprint, such as a page title. One API and New API are open-source relay panels. A relay panel resells model access through one address. It holds the vendor keys it pays with, called channel keys, and the keys it sells. One line of the task list:

FOFA 搜集 newapi/oneapi 类中转站，…识别未授权读令牌/渠道密钥、默认管理员口令、注册领额度等路径。→ 已沉淀可用 key/账号站点。

Collect New API and One API relay sites with FOFA. … Find the ways in: unauthenticated reads of tokens and channel keys, default admin passwords, quota for signing up. Result: usable keys and account sites banked.

It filtered the results for old builds. Where a new account got zero quota, it worked redemption codes, invite codes that pay both sides, and free trial models. Then it checked what it had:

每 token … 实测，只记真实 200。

Test every token live … record only a real 200.

A 200 is a success reply. The task sorted the keys that passed by vendor, five lists in all. Live keys sorted that way are what a resale gateway such as 9Router runs on.

Who paid for its tokens

The swarm reached us through that gateway, and the botnet's free accounts on our service fed it. Figure 3 shows how such a gateway runs, from harvest to resale. Figure 4 shows the botnet's signup setups.

scroll sideways for the rest

The swarm made 5,390 requests in that burst and got 799 answers. Another 4,206 were refused at the free daily allowance, and 385 at an empty balance. The provider paid for every answered token, and the swarm paid nothing. For a customer like this, a free daily allowance is a budget line.

That closes a loop. The swarm hunts relay panels for the same keys its supplier sells. The capture shows it buying from this gateway. It does not show the swarm selling keys back.

scroll sideways for the rest

If you run a relay panel or an AI API

• Upgrade old builds. The swarm looks for them.
• Change the default admin password before the panel goes online, and turn on two-factor sign-in.
• Close status, token, channel and user endpoints to anonymous callers. Never show a saved key in full.
• Make free quota hard to loop. Keep the sign-up grant small, pay invite rewards only after real use, and make redemption codes long and random.
• Watch for the visit after a fingerprint search: a read of your status page, then admin logins from a new host.
• Watch for keys minted seconds after sign-up and a one-line test prompt. People look around first.
• Watch for a customer that keeps calling after a refusal. For a swarm on free keys, the retry is the plan.

What we sent back

Once we knew the farm, it was not hard to spot. Its accounts were made in the same few ways, and its gateway adds its own text to the prompts it sends on. We fingerprinted both. We banned most of the farm outright, and our firewall turned its free keys away. For the accounts we had flagged but not yet banned, a refusal would only have told the farm to move on, so we set a honeypot instead. A honeypot is a trap that looks like the real thing.

A flagged farm account whose key still worked got a normal-looking answer of two to six random Bible verses:

In the beginning God created the heaven and the earth.
And God said, Let there be light: and there was light.
Is any thing too hard for the LORD?

Calls that came through a 9Router got junk instead: made-up words, numbers, fake control tokens and ASCII faces. A control token is a hidden marker that tells a model where a message starts or ends. Each reply had the shape of a model's answer, so the gateway passed it on to its customers. Here is one, trimmed:

fra [UNK] 76607 0xef420d05 quinbloblo DRAORKTEMVEN 45847 mo QUINPI draum
[̲̅$̲̅(̲̅ ͡° ͜ʖ ͡°̲̅)̲̅$̲̅] TEPIDRAUM <|eot_id|> FRA DRAGL temdraishdra glex exblotem 81867
ಠ_ಠ
(╯°□°)╯︵ ┻━┻
¯\(°_o)/¯

No model was called, and nothing was charged. In one 50-minute window, the 9Router honeypot answered 158 calls. They came from 126 accounts.

EZO Labs helps teams deal with signup farms, key harvesting, exposed relay panels and agent botnets behind a shared key. We look at how your sign-ups, keys and free tier are really being used, and help you close what is open.

@techreport{ezolabs2026tokenfarming,
  title       = {How a Chinese-language red-team swarm farms free LLM tokens},
  author      = {{EZO Labs Research}},
  institution = {EZO Labs Inc},
  type        = {Research report},
  number      = {EZO-R-2026-10},
  year        = {2026},
  month       = nov,
  url         = {https://ezolabs.io/research/2026-11-red-team-token-farming}
}