Full disclosure: Sardine’s CEO Soups Ranjan, CPO Zahid Shaikh, and I go back, with plenty of close friends in common. I was at their conference recently and came away a bigger fan of their work than ever. Consider this a friendly reply over coffee, not a rebuttal.
Sardine recently published a sharp piece on how free-trial abuse steals tokens, credits, and sometimes the model itself. The core argument is right: abuse against AI products is no longer a funnel-hygiene problem. It is an infrastructure cost, and it runs as a five-stage supply chain: acquisition, entitlement, coordination, consumption, rotation. The first three stages, Sardine notes, are detectable before a single token is spent.
We agree, and we are going to borrow that model for everything that follows.
We would only push back on one line. The article credits a model provider with catching abuse “because they could see it from the inside,” and suggests most companies serving tokens have no equivalent view. The implication is that an outside view can’t compete with an inside one.
With respect to our friends at Sardine: a sardine, of all creatures, should know that you learn the most about the fish by watching the school. From inside one tin, you see your own fish.
Is what I’m seeing normal?
Sardine’s numbers come from a model owner’s self-disclosures and two network figures from a payments provider. Those are useful, but they leave a fraud lead at a mid-size AI company without an answer to that question.
That needs a base rate. So we measured one.
Over 140 days (June 4 to October 21, 2026), myNetWatchman observed authentication traffic across 43 self-serve products, AI and non-AI, using the same sensors, classifier and window.
- 467.9 million authentication attempts
- 150.2 million distinct identities targeted
- 169,352 accounts confirmed accessed
- 43 products with enough volume to report
A sardine, of all creatures, should know that you learn the most about the fish by watching the school. From inside one tin, you see your own fish.
We keep the second and third numbers apart on purpose. 150 million addresses were tried. 169,352 accounts were accessed. One describes an attacker’s target list, the other describes outcomes, and vendor marketing blurs them far too often.
To protect the companies involved, we refer to products by category and letter (for example, “Voice AI Platform A”) rather than by name.
Finding 1: AI products run about 13x the synthetic-account rate
Across the AI products in our window, 31.98% of accessed accounts were synthetic. Across non-AI products, 2.48%. That is a 12.9x gap.
A fair skeptic will note that two AI products account for most of the AI volume. So we also took the median product, which ignores concentration entirely. The gap barely moved: 16.25% versus 1.20%, or 13.5x. Two estimators, one sensitive to concentration and one immune to it, agree.
The bottom of the table matters as much as the top. A travel booking marketplace sits at 0.8%. A Brazilian football club’s membership portal at 0.2%. A gaming tournament platform at 0.2%. These low rates prove the method isn’t crying wolf. That’s what makes the AI numbers believable.
Finding 2: Stage one, caught in the act
Between September 1 and 25, a single campaign presented 13,123,775 distinct identities for account creation at one AI media generator (“AI Media Generator S”), whose free tier runs on third-party frontier models. Every free generation there has a real marginal cost, paid to someone else.
The campaign went from 26,757 attempts on day one to 3.2 million at its peak on September 4, tapered, came back in a second wave, and vanished after September 21. Organic growth does not draw that shape.
Sixteen IP addresses on two networks produced 99.8% of it.
The company’s own terms of service already prohibited multi-accounting, bots, and proxy pools to farm free credits. They had written the rule. What they lacked was the view that showed it being broken millions of times a day.
Finding 3: Your blocklist catches none of it. Shape does.
Those 13.1 million identities were on gmail.com and icloud.com, split almost evenly. A disposable-domain blocklist catches exactly zero of them.
The bad actors weren’t naive. Addresses ran five to nine characters, some with digits and some without. Someone clearly tried to make them look random.
The obvious signal is a trap. Real people often put a dot or underscore in their address, like jane.smith. Across the farm’s 13.1 million addresses, the count was zero. That’s tempting, but as a rule it’s nearly useless: only about one in five real addresses has punctuation, so “no punctuation” would flag 81% of your real customers.
The real tell is length. People have short names and long names. A generator has to pick a length. Real addresses spread across a wide curve that peaks around 11 to 13 characters. The farm packed 96% of its addresses into just three lengths, and none went past nine.
They randomized the characters. They forgot to randomize the length.
There’s a second tell. 59% of real addresses end in a digit (birth years, house numbers, the year someone signed up). Only 0.5% of the farm’s do.
Stack the signals and the cost drops. “No punctuation” alone flags 81% of real users. Add “short, letters and numbers only” and it falls to 16%. Add “doesn’t end in a digit” and it reaches 7%, while still catching 99.5% of the farm.
7% is still too high to block on. That’s the honest point: you won’t spot one fake account from its address. You’ll spot a group of them. When ten thousand signups in a day have a length spread no human population produces, go look at what else they have in common.
Try it on your own data. Track the spread (standard deviation) of address length by day or channel. Real users sit above four. This farm sat at 0.78. A cohort that drops near one isn’t a quiet week. It’s a machine.
Finding 4: The column you cannot compute from inside your company
This is the finding we most want fraud teams to take away.
For each product, we measured the share of accessed accounts that were also being worked against other, unrelated products in the same window.
At AI Audiobook App B, it was 97.2%. At an AI resume builder, 66.9%. At the largest voice AI platform in our data, 30.9%. At non-AI controls like a travel marketplace, 0.1%
Now picture that audiobook app’s own logs. Logins, velocity, geography. What those logs cannot show, however well-instrumented, is that nearly every one of those identities is being driven against a resume builder, a disposable-number service, and a dozen unrelated apps by the same infrastructure on the same afternoon.
That is not a tooling gap a better in-house pipeline closes. A company’s telemetry ends at its own perimeter. This number replicated, too: an earlier study of ours put the same product at 95.5%.
One honest caveat. Most of that cross-product reuse is not fake signups. It is account takeover of real people: stolen passwords replayed across services. Only 9.1% of identities seen on three or more products were synthetic. Fake accounts and ATO look alike from a distance and need completely different responses. Anyone who merges them into one alarming number sends you after the wrong problem.
A company's telemetry ends at its own perimeter.
Finding 5: The hydra has very few heads
Sardine describes stage three, coordination, as a “hydra cluster.” Here is how many heads it has.
32 attacker IP addresses, each reaching 11 or more products, carried 65.3% of all 467.9 million attempts. The 1,840 addresses that touched only one product carried 1.2% between them. One address on a single hosting network generated 113 million attempts against 39 products, about a quarter of everything we saw.
Read that as a defender: the addresses hitting you hardest are almost certainly hitting someone else at the same time. Watching only your own front door shows you the narrowest possible slice of the thing attacking you.
Watching only your own front door shows you the narrowest possible slice of the thing attacking you.
What we would tell a fraud lead at an AI company
Your signup stream already holds most of the answer. Track the spread of address length against your own users, not a blocklist. Watch how fast new accounts are created per identity. Check mail servers, not domain names: domains are cheap and endless, mail servers are few and stable.
Don’t block real people. Privacy relays like Apple’s Hide My Email are not disposable. Missing one fake account costs you one fraud case. Blocking a real customer costs you that customer for good.
Individual scoring has limits. Cohort scoring doesn’t. No address-level rule could safely flag these 13.1 million fakes, ours included. The length pattern across the whole group gave them away instantly. Score cohorts, not just signups.
The one signal you can’t build yourself is the cross-product view. That’s the honest case for outside data.
Sardine is right that the inside view sees the spend. The outside view sees everything that comes before it.
The mechanics of how email became the digital economy's most consequential vulnerability, the case studies that should have changed everything, and what a continuous intelligence approach actually looks like — all documented in "The Lying Gatekeeper," a special report from myNetWatchman.
Read the Full Report →