Flare for frontier model providers: distillation
Why now
Distillation at scale needs a steady supply of access
In February 2026, Anthropic, OpenAI and Google each reported coordinated model extraction. The campaigns ran through fraudulent accounts, proxy resellers and third-party routers built to mask their source and replace whatever gets banned.
Anthropic traced three campaigns to commercial proxy services that resell frontier model access. One network mixed extraction traffic with ordinary customer requests to hide it, and every banned account was replaced with a new one. OpenAI described DeepSeek-linked accounts reaching its models through obfuscated third-party routers.
Sources: Anthropic, Detecting and preventing distillation attacks, February 23, 2026; OpenAI memo to the House Select Committee on China, February 12, 2026; Google Threat Intelligence Group, February 2026. Caveat: each figure is self-reported and limited to one provider’s platform, so a lower bound.
Anatomy
How one key and one session reach a reseller
Stolen access moves through three steps before it reaches a proxy pool. Flare catches it at the first two. Example values are illustrative.
Flare flags both at steps 1 and 2
Flare matched your key format in the image layer and your domain in the stealer log. The key reached your SOC as an alert and the session reached your fraud stack through the ASTP API, so your team revoked both before a buyer could use them.
Flare assessment, confidence Moderate. Channels that resell frontier model access list stolen keys and hijacked accounts next to accounts created with fake details.
The gap
Your abuse classifiers see stolen access late
Detection on API traffic starts when requests arrive. By then the account has history, the key is valid and a replacement is ready.
Stolen access looks legitimate
A hijacked account brings its age, payment history and normal usage. A leaked key belongs to a paying customer. Both pass the checks you added for new signups.
Leaks happen off your platform
Keys surface in container images, public repos and paste sites. Sessions surface in stealer logs sold on Telegram. None of it reaches your telemetry.
Patterns need volume to show
Distillation shows up as repetition across many accounts. A classifier needs that traffic before it fires, so some extraction has already happened.
Bans get replaced
Resellers run pools of accounts and keys. Banning one leaves the pool intact, and a fresh account takes its place.
How it works
Flare works before the first request
Your classifiers watch traffic. Flare watches the places access leaks and is sold, so you can revoke it before it sends a single prompt.
Flare sets up your identifiers
Flare’s team configures your key prefixes, product domains and console URLs. No access to your traffic or logs.
Flare matches its collection
Public code, container and package registries, paste sites, stealer logs, dark web forums and 57,000+ Telegram channels.
Matches reach your team
Key exposures arrive as alerts in your SIEM or ticketing. Stolen sessions and credentials arrive through the ASTP API.
Your team revokes
Rotate the key, end the session or force a password reset in your own systems.
Exposed NHIs
Find your customers’ leaked API keys
Keys end up in public repos, container images and the env files infostealers sweep from developer laptops. Flare finds keys in your format wherever they surface and sends each one to your SOC.
Your key format is the identifier
Flare’s team sets up watches for yl_live_ and every other prefix you issue, plus the product names that show up in resale listings.
Sources off your platform
Public repositories, Docker Hub and package registries, paste sites, stealer logs and Telegram.
Alerts where your SOC works
Microsoft Sentinel, Splunk, ServiceNow, Jira, Slack, Microsoft Teams and Discord.
Example values. Non-human identities are alerted to your SOC, not remediated by Flare.
ASTP
Catch hijacked accounts before they are resold
Infostealers lift saved logins and live session cookies from your customers’ own devices. Account and Session Takeover Prevention finds both for your domains and delivers them by API, so you can end the session or force a reset first.
Stolen session cookies
Live cookies for your chat app and console skip login and MFA. The Cookie Jar API returns them so you can end the session.
Stolen credentials
Login and password pairs from infected devices, by domain or URL. Force a reset before the first login attempt.
API-first delivery
Pull matches into your fraud stack, SIEM or SOAR, with Python and Go SDKs.
GET /v2/stolen-sessions?domain=chat.yourlab.ai { "domain": "chat.yourlab.ai", "cookie": "__session", "source": "stealer_log", "first_seen": "2026-10-14T09:12:44Z", "expires": "2026-11-12T00:00:00Z", "status": "active" }
Illustrative response. Your fraud stack ends the session.
Questions
What trust and safety teams ask first
Short answers on scope, setup and what Flare does not do.
Does Flare need access to our API traffic or model logs?
No. Flare works from its own collection outside your platform. Nothing sits in your inference path, and you share only the identifiers you want watched.
What do we need to set up?
Nothing. Flare’s team configures your key prefixes, product domains and console URLs as identifiers. Flare then matches them across public code and container registries, paste sites, stealer logs, dark web forums and Telegram, and alerts on each match.
Does Flare revoke keys or sessions for us?
No. Flare detects and delivers. Key exposures arrive as alerts in Microsoft Sentinel, Splunk, ServiceNow, Jira, Slack, Microsoft Teams or Discord. Stolen sessions and credentials arrive through the ASTP API, and your team revokes them in your own systems.
Will this stop every fraudulent account?
No. Accounts created from scratch with fake details never leak, so Flare cannot see them before they are used. Flare covers the part of the supply that is stolen and resold: leaked keys, hijacked accounts and live sessions.
How is ASTP delivered?
Through an API: the leaked credentials API for login and password pairs, and the Cookie Jar API for stolen session cookies. Pull matches into your fraud stack, SIEM or SOAR with the Python and Go SDKs.
Next step
See which of your keys are already exposed
Share your key prefixes and domains. Flare’s team sets them up, runs them against its collection and walks you through what it finds.