A few months ago, an AI startup on Stripe’s platform noticed something strange in its dashboard. Signups were climbing, but activation rates were tanking. The company had a standard playbook: offer a free trial with a generous token allocation, let users experience the product, convert the best ones to paid. It’s the same growth model that built Notion, Slack, and Figma into juggernauts. Except this time, the math didn’t work. Customer acquisition costs had ballooned to $500 per signup. The culprit wasn’t a bad product or a weak funnel. It was AI token theft. Roughly one in six new accounts was a bot or a bad actor, signing up specifically to steal compute tokens and disappear.
AI token theft is the practice of creating fraudulent accounts on AI platforms to steal the compute tokens included in free trials, then reselling or reusing those tokens for unrelated purposes. Patrick Collison, CEO of Stripe, disclosed the scale of the problem at Stripe Sessions 2026 in May, calling it a structural threat to the AI economy. Emily Sands, Stripe’s Head of Data and AI, went further. She called token theft “the most under-discussed topic in AI.”
For founders building AI products right now, this isn’t an abstract security concern. It’s a business model problem that touches growth strategy, unit economics, and the future of product-led growth. Here’s what you need to know, and what to do about it.
Last updated: May 2026
Quick answers
What is AI token theft?
AI token theft is a form of fraud where bad actors create fake accounts on AI platforms to steal the compute tokens included in free trials. Unlike stealing a software login, these tokens have real monetary value because they represent paid compute resources. Fraudsters resell stolen tokens on secondary markets or use them to power their own AI workloads, then disappear before paying.
How do AI startups prevent free trial abuse?
The most effective defenses combine payment-processor-level fraud detection (like Stripe Radar, which assigns real-time risk scores to signups), progressive token unlocking instead of upfront allocations, phone or ID verification before granting compute access, hard rate limits per account, and requiring a payment method on file before any tokens are issued. Some startups are replacing free trials entirely with pay-as-you-go stablecoin micropayments.
What is AI token theft and why is it different?
Traditional software fraud is about getting access to a product without paying for it. Someone shares a login, cracks a license key, or abuses a referral code. The marginal cost to the company is close to zero because serving one more user on a SaaS platform costs almost nothing.
AI token theft flips that equation. Every free trial signup on an AI platform comes with compute tokens, and each token represents real infrastructure spend. When someone signs up for a free trial on an AI coding assistant or chatbot, they’re not just getting access to software. They’re getting a store of value. Tokens can be used at machine speed, resold on gray markets, or redirected to power entirely different AI workloads. It’s closer to someone walking into a bank and walking out with cash than it is to someone pirating a movie.
That distinction matters because it changes the cost structure of fraud. A fraudulent signup on Slack costs Slack fractions of a penny. A fraudulent signup on an AI platform can burn through hundreds of dollars in compute in minutes. Sands described it as a “dine and dash” problem, except the bill arrives at machine speed.
How bad is the token theft problem in 2026?
The numbers from Stripe’s internal data paint a bleak picture. Across AI services running on Stripe, one in six attempted signups is now a bad actor. Free trial abuse has more than doubled over the past six months, with what Sands called “a pretty dramatic acceleration” in the most recent month alone.
For the eight high-growth AI businesses Stripe highlighted at Sessions 2026, Radar blocked more than 3.3 million risky signups in a single month. In a separate analysis of four AI companies over two months, Stripe blocked 550,000 abusive free trials and prevented an estimated $4.4 million in downstream compute costs.
Those are just the ones that got caught. The startup whose CAC hit $500 per signup was hemorrhaging money for months before the pattern became clear. The fraud wasn’t obvious at first because the signups looked normal. Real email addresses, real-seeming usage patterns. The difference only showed up in cohort analysis: trial-to-paid conversion was cratering because a third of “users” were never real prospects.
The scale of the problem has forced some AI companies to kill free trials entirely. That’s a major concession. Product-led growth, the strategy of letting people try before they buy, built some of the biggest companies in SaaS. Dropbox, Zoom, Notion, Canva. Removing it means founders need a completely different go-to-market playbook for a product category that’s barely two years old.
How do fraud rings actually steal AI tokens?
The mechanics are more organized than most founders expect. This isn’t random individuals gaming a free trial. It’s coordinated operations.
According to MindStudio’s analysis of Stripe Radar data, the typical token theft operation involves thousands of human operators running millions of AI agents. The operators create accounts in bulk using disposable email addresses, VPNs, and rotating device fingerprints. Once an account is live, automated agents immediately hit the highest-value API endpoints and begin consuming tokens at maximum speed. The entire token allocation can be drained in minutes.
The stolen tokens get resold on gray markets or redirected to power separate AI workloads. Some fraud rings use the tokens to run their own AI businesses, effectively subsidizing their compute costs with someone else’s free trial budget. Others resell access in bulk at a discount, creating an underground economy of discounted AI compute. The operation mirrors the structure of gift card fraud, except the “cards” are API tokens and the “stores” are cloud GPU clusters.
What makes detection difficult early on is that individual signups can look legitimate. Real email addresses, plausible names, reasonable geographic distribution. The fraud only becomes visible in aggregate: cohort conversion rates that are 3-5x below normal, token consumption curves that spike and flatline within hours, and activation patterns that skip the product’s core features entirely.
Why are AI products uniquely vulnerable to trial fraud?
Three properties make AI products a perfect target for this kind of abuse, and none of them exist in traditional SaaS.
First, tokens have fungible value. A Figma free trial gives you access to Figma. You can’t resell “access to Figma” on a secondary market. But AI compute tokens are interchangeable. They can power any prompt, any model call, any workload. That makes them liquid in a way traditional software access never was.
Second, consumption happens at machine speed. A human user might run 50 queries during a free trial. An automated agent can burn through an entire token allocation in minutes. The MindStudio analysis of Stripe Radar data found thousands of human operators running millions of AI agents specifically to drain trial allocations. The speed asymmetry means fraud rings can strip-mine a free trial program faster than most startups can detect the pattern.
Third, the unit economics are inverted. Traditional SaaS has near-zero marginal costs. Serving one more user is essentially free. AI companies pay per inference call. Every token consumed by a fraudster is real money spent on GPU compute. A solo founder building with AI tools might use $5 worth of compute in a trial. A fraud ring burning tokens at machine speed can consume $500 worth in the same period.
What can founders do to fight AI token theft?
Stripe Radar is the most widely deployed defense right now. It assigns real-time risk scores to signups based on signals like IP address patterns, email domain reputation, device fingerprinting, and behavioral velocity. The system draws on data from Stripe’s entire network, which means it can spot patterns that individual startups can’t see in isolation. For the companies that deployed it, Radar’s results speak for themselves: 3.3 million blocked signups in one month across eight AI companies.
But Radar is a payment-processor-level tool. Founders also need product-level defenses. Here are the tactics that are working right now:
Progressive token unlocking. Instead of dumping a full token allocation into a new account on day one, release tokens in stages tied to verified usage milestones. A new account gets 100 tokens to start. After completing onboarding and making a verified API call, they unlock 500 more. This doesn’t stop all fraud, but it makes the economics worse for attackers who need to burn through large allocations quickly.
Phone or ID verification before compute access. Adding a phone verification step before granting any tokens eliminates the cheapest attack vector: bulk email account creation. It won’t stop sophisticated fraud rings, but it raises the cost per fraudulent signup enough to make low-volume targets unattractive.
Hard rate limits per account and per IP. Cap token consumption velocity. No legitimate user needs to burn through their entire trial allocation in the first 10 minutes. If an account hits 80% of its allocation within the first hour, flag it for review before releasing more tokens.
Require a payment method on file. Even with a $0 charge, requiring a valid credit card before issuing tokens adds a verification layer. It doesn’t eliminate fraud, but it filters out the highest-volume, lowest-sophistication attackers. Companies like fast-growing startups in 2026 are increasingly requiring payment details upfront for this reason.
Behavioral scoring during trials. Real users explore a product. They read docs, try different features, pause between sessions. Fraudulent accounts go straight to the highest-value API endpoint within seconds of activation. Track time-to-first-API-call, feature diversity, and session patterns. Legitimate behavior looks messy. Fraud looks efficient.
| Defense | Friction added | Fraud blocked | Best for |
|---|---|---|---|
| Stripe Radar | None (background) | High-volume bot signups | Any Stripe customer |
| Phone verification | Low (one-time step) | Bulk email account fraud | Consumer AI products |
| Progressive token unlock | Low (invisible to users) | Fast-drain attacks | API-first AI products |
| Payment method required | Medium (card details) | Low-sophistication attackers | B2B AI tools |
| Streaming payments (stablecoins) | High (new payment model) | All non-paying usage | AI infrastructure, APIs |
Are AI free trials dying in 2026?
Not dying. Evolving. The unlimited-free-trial model that worked for traditional SaaS is broken for AI products, but the underlying principle, letting people experience value before paying, is too powerful to abandon. What’s changing is the mechanism.
The most interesting shift is toward streaming payments. Instead of “try for free, then pay,” the model becomes “pay as you consume, starting from the first token.” Stripe is building infrastructure for this through its Tempo blockchain, which enables stablecoin micropayments for AI services in real time. Coinbase’s x402 protocol takes a similar approach: it uses the HTTP 402 status code (literally “Payment Required”) to enable per-request stablecoin payments at sub-cent transaction costs. As of April 2026, roughly 69,000 active AI agents on x402 have processed over 165 million transactions totaling $50 million.
Amazon Web Services launched Bedrock AgentCore Payments in May 2026, a system that lets AI agents make real-time stablecoin purchases using infrastructure built on Coinbase’s x402 and Stripe’s wallet technology. The explosive growth at companies like Anthropic is happening alongside this infrastructure buildout, and the timing isn’t coincidental.
The streaming model eliminates token theft by design. There’s nothing to steal because there’s no upfront allocation. Every compute cycle is paid for at the moment of consumption. The tradeoff is higher friction for new users, which is why most founders are layering approaches: a small verified trial allocation to get users hooked, streaming payments for ongoing usage, and Radar-style fraud detection running in the background.
What does this mean for your AI startup’s growth model?
If you’re building an AI product in 2026, token theft needs to be in your financial model before launch, not after you discover your CAC is five times what you projected. Here’s the framework:
Model fraud as a line item. Budget for 10-15% of trial signups being fraudulent. That’s conservative given Stripe’s 1-in-6 figure, but it gives you a realistic floor for unit economics planning. If your model only works when every trial signup is genuine, your model doesn’t work.
Track token consumption velocity as a fraud signal. Build alerts that flag accounts consuming tokens faster than your 90th-percentile legitimate user. This data doubles as product analytics: it shows you how real users actually engage with your product versus how bots do.
Design your trial around verification, not generosity. The old SaaS playbook was “be generous with free stuff and convert later.” The AI playbook is “verify first, then be generous.” A one-person business running an AI product can’t afford to subsidize fraud rings with compute costs.
Consider hybrid monetization. Offer a genuinely free tier with strict token limits (enough to evaluate, not enough to exploit), a paid trial with higher limits and full features, and usage-based pricing after that. The key is making the free tier useful enough to convert but small enough that stealing it isn’t worth the effort.
How does token theft affect AI startup fundraising?
Investors are catching on. When a Series A candidate shows impressive signup numbers but weak conversion rates, the first question from informed VCs in 2026 is whether the signups are real. Token theft inflates vanity metrics in ways that are easy to miss and dangerous to ignore.
Gross signup numbers, free trial activations, even “monthly active users” can all be artificially inflated by fraudulent accounts. A startup reporting 100,000 free trial signups might have 15,000-17,000 fraudulent accounts baked into that number. If the company’s pitch deck projects conversion rates based on pre-fraud baselines, the entire financial model is built on bad data.
Smart founders are getting ahead of this by reporting fraud-adjusted metrics to investors. Show the raw numbers, show the fraud-filtered numbers, and show the delta. The founders who proactively disclose their fraud rate and explain their mitigation strategy signal sophistication that investors in 2026 are actively looking for. Hiding behind inflated signups is a short-term play that blows up at due diligence.
This dynamic also shifts the competitive landscape. Companies that solve fraud prevention early gain a structural advantage: their unit economics are real, their conversion data is clean, and they can invest in growth without burning cash on subsidizing fraud rings. In a market where the best businesses to start in 2026 increasingly involve AI, fraud prevention isn’t a cost center. It’s a competitive moat.
The founders who’ll win in the AI economy aren’t the ones offering the most generous free trials. They’re the ones who figured out how to let real customers experience the product while making fraud economically pointless. That’s a harder problem than building the product itself, and it’s one that every AI startup needs to solve.
