Protecting against token theft
By Steven Van ·
Vercel details an April attack on its own docs chatbot and how per-request BotID checks stopped it within a day.
On 12 April 2026, traffic to Vercel's docs AI chat endpoint spiked to ten times its normal volume on Anthropic's Claude Haiku 4.5 model, reaching 1,300 requests per minute at peak, a run rate of more than $10,000 a day in inference costs. The traffic came through residential proxies that masked the real client IPs, so standard per-IP rate limits had nothing to act on.
Vercel's fix was to gate every AI request, not just the session or signup, through BotID deep analysis. During the attack, BotID detected and blocked more than 10,000 bot requests within the first minutes, and request volume was back to normal within 24 hours.
The company describes this as a general risk for any AI endpoint exposed to the internet: inference costs far more per call than the HTTP requests that carry it, so stolen calls can be resold at a discount for high margin. It cites Chipotlai Max, a forked coding agent that wraps Chipotle's customer-support chatbot in an OpenAI-compatible adapter, as an example, noting the project is soliciting help porting the same approach to Home Depot, Lowe's, Target and Starbucks.
To defend against inference theft, Vercel recommends:
- Auditing which AI endpoints are exposed to the internet
- Prioritizing endpoints by attack likelihood, since more caller control over the prompt makes for an easier target
- Gating every endpoint on every request, rather than once per session
The announcement walks through implementing this with BotID's checkBotId() call inside a Next.js route handler, paired with a client-side declaration of the protected route.
