How Nous Research used BotID to block automated abuse at scale
By Steven Van ·
Nous Research used Vercel's BotID to stop a 3,000% traffic spike from bots exploiting its free Hermes chat tier.
When Nous Research made its open-source model Hermes free for a week, automated scripts overwhelmed the service, spreading high-volume inference requests across thousands of fake accounts to bypass rate limits. Cloudflare Turnstile was already in place on sign-up, but bulk account creation continued, wasting inference compute and inflating identity provider bills.
Before reopening any free tier, Nous adopted Vercel's BotID Deep Analysis at two checkpoints: before and after sign-up or sign-in, and inside the chat UI itself, where a heartbeat mechanism triggers periodic BotID checks via tRPC and caches successful checks briefly so inference only proceeds after a recent human verification.
When Nous quietly reopened the free tier on 16 October without any promotion, BotID detected a coordinated attack within days that pushed traffic up 3,000%. Five to six IPs generated most of the load, mostly from Japan, with 3 to 4 distinct JA4 hashes recurring across attempts. The attack lasted about two hours before attackers gave up, and inference traffic and availability stayed stable throughout. Enterprise and Pro teams can use BotID Deep Analysis free of charge through 15 January.
