OpenAI's new rules require model routing and AI gateways to obtain approval first; relay stations face being brought to heel

By | Letter List

OpenAI has begun issuing "operating licenses" to relay stations, and the good days for wildcat relay stations are over.

Recently, OpenAI issued an announcement that a new version of its usage rules takes effect starting November 20: services that provide direct model access to third parties, such as model routing and AI gateways, must first undergo OpenAI review and approval; calls made within one's own app are unaffected.

This means that relay stations whose main business model is forwarding calls to OpenAI's large models face a severe test.

In fact, long ago professional teams discovered through actual testing that the same OpenAI API, once it enters a relay station, exhibits "dumbed-down" behavior, with relay station API benchmark scores at most nearly half lower than the official OpenAI API.

However, OpenAI's strict control of the API is not only to ensure API quality and user experience; more importantly, relay stations are stealing OpenAI's business.

Because relay stations' upstream sources are not only OpenAI's official direct service; some may come from "low-price account pools." Based on this, relay stations can sell APIs at ultra-low prices, thereby affecting OpenAI's own revenue.

b.ai, a relay station founded by Justin Sun less than half a year ago, has become one of the platforms more affected by this new OpenAI rule.

But here's the question: why doesn't OpenAI simply issue a ban and uproot the entire industry?

Banning account pools, identifying traffic fingerprints, cutting off distribution paths—it would be easy as pie for OpenAI to completely exterminate relay stations.

Suppressing without eliminating has never been about lack of ability; it is about keeping them useful. Liangshan in "Water Margin" was to the imperial court what relay stations are to OpenAI.

01

The original OpenAI announcement states that the updated usage policy requires that "services that provide direct model access, such as model routers or AI gateways," must obtain OpenAI's review and approval before providing such access.

Those that merely connect OpenAI models into their own applications to implement functionality are not subject to this restriction.

In plain terms, if you build an app that calls GPT in the backend, OpenAI won't bother you. But if you transfer the right to call GPT to someone else, then you must obediently follow OpenAI's rules.

The announcement also says that OpenAI states GPT's protection is divided into two layers: the first layer is protection built into the model, and the second layer relies on the systems and people around the model.

The first layer is like a factory-issued immunity stamp; when OpenAI trains the model, it writes safety requirements into the parameters, such as refusing harmful requests and not being fooled by jailbreak instructions. This layer travels with the model—wherever the model is, the defense line is there, and relay stations cannot remove it.

But the second layer is like a security gate, such as risk control systems identifying suspicious traffic, API key management, monitoring logs, manual review, abuse investigations, and SafetyID. This layer is not in the model but in the environment around the model.

Therefore, the new rules require that models always maintain these two layers of protection. For these partners, OpenAI made three requirements: maintain safety measures consistent with its own; investigate potential violations and take appropriate action; and "wanted across the entire network"—if a user is banned on site A, then site B is also not allowed to serve them.

Regarding the SafetyID mentioned in the announcement: customers can provide OpenAI with an identifier to help OpenAI distinguish different end users during investigations, and OpenAI will not know who these users are. The benefit is more precise handling and fewer collateral hits.

Because the relay station model is that multiple users share one upstream key, OpenAI can only see "one caller." Once someone abuses it, the only thing that can be acted on is the entire key, which is unfair to those who use it compliantly.

In this update, OpenAI also mentioned that relay stations are prohibited from using OpenAI models or their outputs to prepare, screen, or provide training data and signals for models that replace or compete with OpenAI, including building training tasks, reinforcement learning environments, and feedback such as scoring and ranking. At the same time, extracting protected reasoning content through unauthorized access, reverse engineering, and other means is prohibited.

Relay stations happen to be the place for large-scale calls and outputs. OpenAI does not want others to distill their models through relay stations, so the new rules are also a form of anti-distillation.

Long ago, research teams discovered through actual testing that the same model, when called within a relay station, exhibits "dumbed-down" behavior.

The paper "Real Money, Fake Models: Deceptive Model Claims in Shadow APIs" (arXiv:2603.01919, accepted by ACM CCS 2026) states that the research team conducted a systematic comparative audit of official APIs and relay station APIs.

Auditing from three dimensions—utility, safety, and model verification—they found a performance gap of up to 47.21%, significant unpredictability in safety behavior, and identity verification failures in 45.83% of fingerprint tests.

This is mainly due to multi-tenant rate limiting, which limits GPU time and tool call counts for individual requests. Coupled with heavier post-processing chains such as review, rewriting, and filtering, answers naturally become "dumbed down."

Issuing "operating licenses" to relay stations is also about ensuring the user experience of its own models; OpenAI does not want relay stations to ruin GPT's reputation.

OpenAI tightening up isn't just about quality—it's also about money.

The main operating model of relay stations is to wrap upstream large-model APIs into a unified interface and then forward them to downstream users.

And the upstream of relay stations isn't only OpenAI's official direct service. Many relay stations rely on bulk account registration, reselling free quotas, or splitting one subscription account among multiple people for shared use.

What many relay stations use to obtain accounts is called an "account pool"—that is, many accounts are pooled together, and when users call the API through the relay station, the quota in the account pool is used directly.

Because the accounts in the account pool mainly come from stolen accounts, leaks, and subscriptions purchased during discount periods, the account pool is as cheap as 5% to 30% of the official price.

There is also an intriguing backdrop here: Tibo announced "full quota reset for all users" multiple times this year. As the available quota of subscription accounts is reset again and again, for people who split and resell them, the unit cost may be further diluted.

So if relay stations are not controlled, it will affect OpenAI's own normal business.

02

Justin Sun's b.ai was affected by this change in OpenAI's new rules.

On May 1, 2026, Tron founder Justin Sun announced on social media that "the strongest AI relay station in history, b.ai, is here," with the slogan "one API Key = Claude + GPT + Gemini + the full series of domestic large models."

Justin Sun publicly said that he subsidizes at least 100,000 RMB and 10 billion tokens per day. On May 7, Justin Sun said registered users had exceeded 1.7 million.

Besides the relay station business, b.ai also comes with a "wealth management" feature—which is itself very "Justin Sun."

New users receive 500,000 points, paying with USDT earns an extra discount, and while users' deposited stablecoins remain on the platform, they are also connected to the DeFi ecosystem to generate wealth management returns.

In early July, b.ai's user scale exceeded 2 million, with single-day token throughput reaching a peak of 18.69 billion.

The point where b.ai is affected is not only "whether it has GPT," but also that its users are anonymous.

Justin Sun emphasized blockchain login and anonymous payments, but the new rules require partners to have the ability to investigate violations and coordinate enforcement, and the SafetyID design is also meant to distinguish end users. "Anonymity" and "accountability" are clearly two completely conflicting concepts.

Once OpenAI's new rules are enforced, b.ai will either have to make major changes or completely give up GPT.

Also on May 1, Cheetah Mobile chairman and CEO Fu Sheng announced the launch of EasyRouter, which uses a unified interface to call more than 40 models including GPT, Claude, Gemini, and DeepSeek, gives new users 400 points, and offers a 15% discount across all models.

Fu Sheng's judgment is that models will quickly become commoditized, and the real profit is not in the models themselves but in the connection layer. He emphasizes compliance, stability, and enterprise services, profits from price spreads and scale, and publicly states that it is an official direct connection.

However, even if EasyRouter goes through cloud vendors such as AWS Bedrock and Azure for hosting, OpenAI can still follow the network cable to review EasyRouter.

Fu Sheng repeatedly emphasizes that he is a certified partner of Google Cloud and AWS and has channel discounts. If that is really the case, EasyRouter belongs to the category of companies that "can declare."

Speaking of declaring, OpenRouter is the top player in this track. Through its single interface, users can call more than 300 open-source and closed-source models; it charges a 5.5% fee on top-ups, with prices consistent with model vendors; an a16z report says it serves more than 5 million developers.

In May 2026, OpenRouter completed a Series B funding round at a valuation of $1.3 billion, with annualized revenue exceeding $50 million.

In August, Stripe, the world's largest payments company, announced the acquisition of OpenRouter. According to foreign media reports, the acquisition price was about $7.5 billion. OpenRouter said in its announcement that its products, mission, and existing commitments remain unchanged.

Among all the relay stations named by OpenAI, OpenRouter is the one most positioned to complete the approval process.

Beyond relay stations, another group of people has also been affected: those selling quotas on Xianyu and Shopify.

For example, those Xianyu sellers with slogans like "44.9 RMB per month, unlimited quota" and "1 RMB for 2.85 million tokens." The reason they are cheap is that the quota comes from the account pools mentioned earlier.

Although these quotas are cheap, they carry extremely serious security risks.

The paper "Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain" mentions that researchers bought 28 paid relay stations from Xianyu and Shopify stores, and also collected 400 free relay stations from public communities for testing.

The results showed that 9 had active malicious code injection, 17 attempted to steal credentials from Amazon cloud honeypots, and 1 directly stole Ethereum assets.

These individual sellers are not good actors to begin with. They use accounts from account pools and also attack their own customers—so don't expect OpenAI to give them licenses.

03

It is quite obvious that this time OpenAI is suppressing without eliminating.

If OpenAI wants to make relay stations uncomfortable, it has many means at its disposal. It can ban upstream accounts, identify traffic fingerprints, and cut off payment channels—any one of these is possible.

But this time it did not issue an "extermination order"; instead, it wants to co-opt these relay stations.

Suppressing without eliminating is never a matter of lacking ability; it is about keeping them useful. As mentioned at the beginning, Liangshan in "Water Margin" is to the imperial court what relay stations are to OpenAI.

In the story of Liangshan Marsh, many people only remember the "gathering of heroes" but overlook the court's attitude. In "Water Margin," the government troops launched two large-scale campaigns of suppression, and Tong Guan and Gao Qiu were defeated one after another.

The court could not uproot Liangshan, so it turned to co-optation, granting titles to Song Jiang and the others. Next, this group fought the Liao on behalf of the court, then campaigned against Tian Hu, Wang Qing, and Fang La.

Relay stations are the same.

First, relay stations are OpenAI's "pioneer corps."

The use of frontier models is often hindered by high prices, payment obstacles, and regional restrictions, and it is these restrictions that gave rise to relay stations. These people cannot directly access OpenAI's official website, but they are loyal GPT users.

If Liangshan were wiped out, these people would not obediently return to the official website and pay; they would simply switch models. Relay stations already offer Claude, Gemini, and domestic models, so the switching cost is almost zero.

So for OpenAI, relay stations are outposts that hold the lost territory for it.

Second, customers with small amounts, high risk, and difficult compliance are taken on by relay stations.

Some customers with small amounts, unclear purposes, and inconvenience in using official compliant channels—if they are uniformly handled by relay stations, OpenAI does not need to provide customer service or bear responsibility for them, yet it can still get money from upstream.

Even better, the new rules require partners to investigate violations and coordinate enforcement. This is equivalent to shifting part of the risk control and regulatory costs onto approved relay stations. The official side no longer needs to watch end users one by one; it lets the "distributors" guard the gate for it.

Third, the co-opted channels are eyes against distillation.

As mentioned earlier, OpenAI has added clauses to relay stations prohibiting distillation. Once relay stations are brought into the access system, it is equivalent to installing anti-distillation measures on all channels.

This is like after the Liangshan heroes were incorporated, the court sent them to fight Fang La; what they were used for was often the work the court itself found inconvenient to do. This point is also speculation.

The announcement states that after OpenAI restricts a certain access, if behavior, commitments, or security measures undergo meaningful changes sufficient to address the original concerns, it will re-examine these restrictions.

As the saying goes, heroes are not asked where they come from; what happened in the past does not matter. As long as they are willing to change and willing to join the establishment, OpenAI's door is always open.

The announcement also emphasizes that enforcement decisions are based on documented behavior and risks and must be consistent and proportionate. But the official side did not provide details on the specific mechanism.

In "Water Margin," after the Liangshan heroes joined the establishment, their fate was in the court's hands, and in the end, what Song Jiang drank was a cup of poisoned wine.

For relay stations, being approved also means that prices, customer information, and risk control standards all depend on upstream's mood. Once the approval threshold is established, it may instead become a moat for the leading platforms that obtain approval.

A ban is one-time; approval is long-term. One-time means can only bring one-time results; only long-term means can bring long-term control.

Suppressing without eliminating is more like a business than wiping them out completely.