Starting November 20, OpenAI requires model routers and AI gateways to obtain approval first

[[**Starting November 20, OpenAI will require third-party model routing and AI gateways to obtain approval first, hitting relay stations; it chose to "co-opt" rather than ban them, and Justin Sun's b.ai faces major changes or abandoning GPT due to its anonymous mode.**

**Key points**

**1. The new rules only restrict resale, not personal use**

Starting November 20, services that provide direct model access to third parties, such as model routers and AI gateways, must first obtain OpenAI's review and approval; only calling GPT from one's own app is unaffected.

**2. Relay stations have poor quality and low prices that hurt revenue**

Audits show that relay station API performance is up to 47.21% lower than official, and 45.83% of fingerprint tests failed identity verification; some platforms use account pools to push prices down to 5%-30% of official, and the new rules use SafetyID and cross-site bans to promote accountability.

**3. b.ai's anonymous mode conflicts with the new rules**

Justin Sun's b.ai attracts customers with blockchain login, anonymous payments and USDT discounts, with users exceeding 2 million and peak daily throughput of 18.69 billion tokens; but the new rules require investigating violations and coordinating enforcement, so b.ai must either undergo major changes or abandon GPT.

**4. Not banning them is for long-term control**

OpenAI keeps relay stations because they can reach users that official channels struggle to reach, take on small high-risk customers, and serve as eyes against distillation; the approval threshold may also become a moat for compliant leading platforms such as OpenRouter. 2026-10-26 16:46 OpenAI "co-opts" Justin Sun Letter List Quick Overview

This article is from the WeChat public account: Letter List, author: Miao Zheng

OpenAI has begun issuing "operating licenses" to relay stations, and the good days for wildcat relay stations are over.

Recently, OpenAI issued an announcement that new usage rules take effect from November 20: services that provide direct model access to third parties, such as model routing and AI gateways, must first obtain OpenAI's review and approval, while calls within one's own app are unaffected.

This means that relay stations whose main business model is relaying calls to OpenAI's large models face a severe test.

In fact, professional teams discovered through actual testing long ago that the same OpenAI API, once it enters a relay station, suffers from "dumbed-down" performance, and relay station API scores can be nearly half lower than OpenAI's official API at most.

However, OpenAI's strict control of the API is not only to ensure API quality and user experience; more importantly, relay stations are stealing OpenAI's business.

Because relay stations' upstream sources are not only OpenAI's official direct sales; some may come from "low-price account pools." Based on this, relay stations can sell APIs at ultra-low prices, thereby affecting OpenAI's own revenue.

b.ai, a relay station founded by Justin Sun less than half a year ago, has become one of the platforms more affected by OpenAI's new rules.

But here is the question: why doesn't OpenAI simply issue a ban and uproot the entire industry?

Banning account pools, recognizing traffic fingerprints, and cutting off distribution paths—it would be easy for OpenAI to completely exterminate relay stations.

Suppressing without eliminating has never been about lack of ability; it is about keeping them useful. Liangshan in "Water Margin" was to the imperial court what relay stations are to OpenAI.

The original OpenAI announcement says that the updated usage policy requires "services that provide direct access to models, such as model routers or AI gateways" to obtain OpenAI's review and approval before providing such access.

Those who merely integrate OpenAI models into their own applications to implement functions are not subject to this restriction.

In plain terms, if you make an app that calls GPT in the background, OpenAI won't bother you. But if you transfer the right to call GPT to others, then you must obediently listen to OpenAI.

The announcement also says that OpenAI states GPT's protection is divided into two layers: the first layer is protection built into the model, and the second layer relies on the systems and people around the model.

The first layer is like a factory-issued immunity stamp; when OpenAI trains the model, it writes safety requirements into the parameters, such as refusing harmful requests and not being fooled by jailbreak instructions. This layer travels with the model; wherever the model is, the defense line is there, and relay stations cannot remove it.

But the second layer is like a security gate, such as risk control systems identifying suspicious traffic, API key management, monitoring logs, manual review, abuse investigations, and SafetyID. This layer is not in the model, but in the environment around the model.

Therefore, the new rules require that models always maintain these two layers of protection. For these partners, OpenAI made three requirements: maintain safety measures consistent with its own; investigate potential violations and take appropriate action; and "wanted across the entire network"—if a user is banned on site A, then site B is also not allowed to serve them.

Regarding the SafetyID mentioned in the announcement: customers can provide OpenAI with an identifier to help OpenAI distinguish different end users during investigations, while OpenAI will not know who these users are. The benefit is more precise handling and fewer mistaken hits.

Because the relay station model is that multiple users share one upstream key, OpenAI can only see "one caller," and once someone abuses it, the only thing that can be acted on is the entire key, which is unfair to those who use it compliantly.

In this update, OpenAI also stated that relay stations are prohibited from using OpenAI models or their outputs to prepare, screen, or provide training data and signals for models that replace or compete with OpenAI, including building training tasks, reinforcement learning environments, and feedback such as scoring and ranking. At the same time, extracting protected reasoning content through unauthorized access, reverse engineering, or other means is prohibited.

Relay stations happen to be the place for large-batch calls and outputs. OpenAI does not want others to distill their models through relay stations, so the new rules are also a disguised form of anti-distillation.

Long ago, a research team found through actual testing that the same model, when called through a relay station, exhibits "dumbed-down" performance.

The paper "Real Money, Fake Models: Deceptive Model Claims in Shadow APIs" (arXiv:2603.01919, accepted by ACM CCS 2026) states that the research team conducted a systematic comparative audit of official APIs and relay station APIs.

Auditing from the three dimensions of utility, safety, and model verification, they found performance gaps of up to 47.21%, significant unpredictability in safety behavior, and identity verification failures in 45.83% of fingerprint tests.

This is mainly due to multi-tenant rate limiting, which restricts the GPU time and number of tool calls per request. Combined with heavier post-processing chains such as moderation, rewriting, and filtering, the answers naturally become "dumbed down."

Issuing "operating licenses" to relay stations is also a way to ensure the user experience of their own models; OpenAI does not want relay stations to ruin GPT's reputation.

OpenAI's tightening is not just about quality, but also about money.

The main operating model of relay stations is to wrap upstream large model interfaces into a unified interface and then forward them to downstream users.

And the upstream of relay stations is not only OpenAI's official direct service. Many relay stations rely on bulk account registration, reselling free quotas, or splitting one subscription account among multiple people for sharing.

Many relay stations get their accounts from what is called an "account pool," which puts many accounts together; when users call the API through the relay station, the quota in the account pool is used directly.

Since the accounts in the account pool mainly come from stolen accounts, leaks, and subscriptions during discount periods, the account pool is as cheap as 5% to 30% of the official price.

There is also an intriguing background here: Tibo announced multiple times this year a "full reset of quotas for all users." As the available quota of subscription accounts is reset again and again, for those who split and resell them, the unit cost may be further diluted.

So, if relay stations are not controlled, it will affect OpenAI's own normal business.

Justin Sun's b.ai was affected by this change in OpenAI's new rules.

On May 1, 2026, TRON founder Justin Sun announced on social media that "the strongest AI relay station in history, b.ai, is here," with the slogan "one API Key = Claude + GPT + Gemini + the full series of domestic large models."

Justin Sun publicly said that he would subsidize at least 100,000 yuan per day and 10 billion tokens. On May 7, Justin Sun said that registered users had exceeded 1.7 million.

In addition to the relay station business, b.ai also comes with a "wealth management" feature, which is itself very "Justin Sun."

New users receive 500,000 points, paying with USDT enjoys an additional discount, and the stablecoins users deposit, while retained on the platform, are also connected to the DeFi ecosystem to generate wealth management returns.

In early July, b.ai's user scale exceeded 2 million, with single-day token throughput reaching a peak of 18.69 billion.

The point where b.ai is affected is not only "whether it has GPT," but also that its users are anonymous.

Justin Sun emphasized blockchain login and anonymous payment, but the new rules require partners to have the ability to investigate violations and coordinate enforcement, and the SafetyID design is also intended to distinguish end users. "Anonymity" and "accountability" are obviously two completely conflicting concepts.

Once OpenAI's new rules are enforced, b.ai will either undergo major changes or completely give up GPT.

Also on May 1, Cheetah Mobile Chairman and CEO Fu Sheng announced the launch of EasyRouter, which uses a unified interface to call more than 40 models including GPT, Claude, Gemini, and DeepSeek, gives new users 400 points, and offers a 15% discount on all models.

Fu Sheng's judgment is that models will quickly become commoditized, and the real profit is not in the models themselves but in the connection layer. He emphasizes compliance, stability, and enterprise services, profits from price differences and scale, and publicly stated that it is an official direct connection.

However, even if EasyRouter goes through cloud vendors such as AWS Bedrock and Azure for hosting, OpenAI can still follow the network cable to review EasyRouter.

Fu Sheng repeatedly emphasized that he is a certified partner of Google Cloud and AWS and has channel discounts. If that is true, then EasyRouter belongs to the category of companies that can "declare."

Speaking of declaring, OpenRouter is the top player in this track. Through its single interface, users can call more than 300 open-source and closed-source models; it charges a 5.5% fee on top-ups, with prices consistent with model vendors; an a16z report says it serves more than 5 million developers.

In May 2026, OpenRouter completed a Series B funding round at a valuation of $1.3 billion, with annualized revenue exceeding $50 million.

In August, Stripe, the world's largest payments company, announced its acquisition of OpenRouter; according to foreign media reports, the purchase price was approximately $7.5 billion. In its announcement, OpenRouter stated that its product, mission, and existing commitments remain unchanged.

Among all the relay stations mentioned by OpenAI, OpenRouter is the type best positioned to make it through the approval process.

Beyond the relay stations, another group of people has also been affected: those selling credits on Xianyu and Shopify.

For example, those Xianyu sellers advertising slogans like "44.9 yuan per month, unlimited quota" and "1 yuan for 2.85 million tokens." The reason they are so cheap is that the credits come from the account pools mentioned earlier.

Although these credits are cheap, they carry extremely serious security risks.

The paper "Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain" mentions that researchers bought 28 paid relay stations from Xianyu and Shopify stores, and also collected 400 free relay stations from public communities for testing.

The results showed that 9 had active malicious code injection, 17 attempted to steal credentials from AWS honeypots, and 1 directly stole Ethereum assets.

These individual sellers are hardly good actors to begin with; they use accounts from account pools and even attack their own customers, so there is no reason to expect OpenAI to grant them licenses.

One can clearly sense that this time OpenAI is suppressing without eliminating.

If OpenAI wants to make relay stations uncomfortable, it has many means at its disposal. Banning upstream accounts, identifying traffic fingerprints, cutting off payment channels—each of these is doable.

But this time it did not use an "order of extermination"; instead, it wants to co-opt these relay stations.

Suppressing without eliminating has never been about lacking the ability; it is about keeping them useful. As mentioned at the beginning, Liangshan in "Water Margin" is to the imperial court what relay stations are to OpenAI.

In the story of Liangshan Marsh, many people only remember the "gathering of heroes" but overlook the court's attitude. In "Water Margin," the government army launched two large-scale campaigns of suppression, and Tong Guan and Gao Qiu suffered defeats one after another.

The court could not uproot Liangshan, so it turned to co-optation, granting amnesty and titles to Song Jiang and the others. Next, this group was sent to campaign against the Liao, then against Tian Hu, Wang Qing, and Fang La.

The same is true of relay stations.

First, relay stations are OpenAI's "pioneer corps."

Access to frontier models is often hindered by high prices, payment barriers, and regional restrictions, and it is precisely these restrictions that gave rise to relay stations. These people cannot directly access OpenAI's official website, yet they are loyal GPT users.

If Liangshan were wiped out, these people would not obediently return to the official website and pay; they would simply switch models. Relay stations already offer Claude, Gemini, and domestic models, and the switching cost is almost zero.

So for OpenAI, relay stations are outposts guarding its lost territory.

Second, small-amount, high-risk, hard-to-comply customers are taken on by relay stations.

Some customers with small amounts, unclear purposes, or inconvenience in going through official compliance channels—if relay stations take them on uniformly, OpenAI does not need to provide customer service or bear responsibility for them, yet it can still get paid from upstream.

Even better, the new rules require partners to investigate violations and coordinate enforcement. This is equivalent to shifting part of the risk control and regulatory costs onto approved relay stations. The official side no longer needs to watch end users one by one; it lets the "distributors" keep watch for it.

Third, the co-opted channels are eyes against distillation.

As mentioned earlier, OpenAI has added clauses prohibiting distillation to relay stations. Once relay stations are brought into the access system, it is equivalent to installing anti-distillation measures across all channels.

This is like the Liangshan heroes being incorporated and then sent by the court to attack Fang La; what they are used for is often the work the court itself finds inconvenient to do. This point is likewise speculation.

The announcement states that after OpenAI restricts a certain access, if the behavior, commitments, or security measures change in a meaningful way sufficient to address the original concerns, it will re-examine these restrictions.

As the saying goes, heroes are not asked where they come from; what happened in the past does not matter. As long as they are willing to change and willing to join the establishment, OpenAI's door is always open.

The announcement also emphasizes that enforcement decisions are based on documented behavior and risk and must be consistent and proportionate. But the specific mechanism was not detailed by the official side.

In "Water Margin," once the Liangshan heroes joined the establishment, their fate was in the court's hands, and in the end, what Song Jiang drank was a cup of poisoned wine.

For relay stations, being approved also means that prices, customer information, and risk control standards will all depend on upstream's mood. Once the approval threshold is established, it may instead become a moat for the leading platforms that obtain approval.

A ban is one-time; approval is long-term. One-time means can only bring one-time results; only long-term means can bring long-term control.

Has published 787 articles on Huxiu. This content comes from the internet; original link. The views represent only the author and do not represent Huxiu's position. If there are copyright issues, please contact hezuo@huxiu.com, and we will verify and handle them promptly. Everyone who is changing and wants to change the world is on the Huxiu APP[ ]