API abuse and agent farming of free tiers

API abuse is the use of a product's own interface against the product's interests: consuming quota, compute, or data at scale without paying, in ways the API technically permits but the business never intended. It is not breaking in. Abusers use the front door, with valid keys and well-formed requests, which is exactly why it is hard to stop with perimeter security. Agent farming of a free tier is the same shape at signup and key issuance: automation that looks like a user until the credits are gone.

The common shapes

• Scraping: systematically pulling data through read endpoints to rebuild your dataset elsewhere.
• Quota farming: many free-tier accounts, each used politely, summing to industrial consumption.
• Resale: wrapping your API in someone else's product and collecting the margin on your compute.
• Credential sharing: one paying subscription serving a team, a company, or a forum.
• Reconnaissance: probing endpoints, enumerating ids, and testing limits before a larger pull.
• Agent farming: autonomous agents signing up, integrating, extracting value, and adapting when blocked, without a human in the loop.

Why it grew

Three shifts compounded. First, everything valuable moved behind APIs, so extraction is a client problem, not a hacking problem. Second, residential proxies and rotating identities made per-IP defenses cheap to evade. Third, agents arrived: software that can read your docs, sign up, integrate, and adapt to friction on its own. An actor that used to need a team now needs a prompt and a budget.

The result is that abuse volume no longer correlates with attacker sophistication. The cheapest actor can now do what a well-funded one could, which means the question for any API business shifts from who is doing this to what each action costs me.

Responses that fail

What works: price the action

Abuse is an economic problem, so the durable response changes the economics. Make every consequential action carry a decision: verified humans and known-good integrations pass silently, cheap automation pays a small computational price (proof-of-work is ideal: trivial for one client, expensive multiplied across a farm), and clear extraction patterns get denied outright.

Two properties make this hold up. It is per-action, so identity games do not reset the clock. And it learns: outcomes reported back (this key farmed, this account converted) tune where the boundary sits for the next action.

Chitmark implements exactly this loop for signups and agent actions: verify returns allow, challenge, or deny in under 50 ms, feedback joins the business outcome to the original event id, and the weekly ledger prices what the abuse was costing you. The economics page has the calculator; the comparison page maps this against rate limiting, CAPTCHAs, and fingerprinting.