Dax Raad, co-founder of OpenCode, revealed that someone registered for their inference service and posed as the CEO of a real company, claiming they would spend $400,000 in the coming year and requested an increase in API rate limits.

The salesperson felt something was off and searched for past videos of the CEO; the face and voice in the meeting matched almost perfectly, leading them to initially believe the client was genuine. Further investigation revealed that the individual used a domain mimicking a real company, registered only four days prior; the traffic was abnormal and originated from overseas. When the team requested additional identification, the individual claimed they were about to board a flight and could not provide materials, insisting on opening the quota first. Raad contacted the real CEO via Instagram, who was completely unaware of the situation. The CEO in the meeting was a real-time deepfake.

OpenCode, developed by Anomaly, offers coding agents and inference interfaces for developers. Raad stated he is not the CEO. In August, the team cleared 7,013 fraudulent accounts, estimating a monthly savings of about $400,000; methods included bulk registration, rotating proxies to resell tokens, and chargebacks after promotional offers, often using stolen card numbers, with traffic concentrated on six addresses at the time.

Similar attacks have expanded from transfers to computing power. In 2024, a finance staff member from Arup's Hong Kong office participated in a video meeting where the finance director and several colleagues were all fakes, ultimately leading to a transfer of about $25.6 million. Stripe CEO Patrick Collison stated that one in six newly registered users at some AI companies is a token theft; data and AI head Emily Sands noted that attackers burn through inference costs at machine speed and then disappear, with free trial abuse doubling within six months, and some clients burning over $500 in tokens for each new paid user.

Video verification is no longer the final line of defense. Buyers are groups looking to resell or use inference at low prices, while sellers operate on a quota billing model, acquiring customers through promotions. The incident was driven by large intent and speed-up requests. Beneficiaries include deepfake-as-a-service and the gray token market, while those under pressure are AI companies that prepay GPU hours to "look like customers."

Source: Public Information