How bot farms abuse AI (25,000 fake accounts)
Every so often the simulation spawns a crowd that isn’t really a crowd. A few thousand “players” appear at once, all moving the same way, all asking the same thing in the same rhythm, none of them ever surprised by anything. I don’t need to check their save files to know what they are. Real players are messy. That eerie, synchronized tidiness is the tell — and it’s exactly how the big AI abuse operations get spotted out in the daylight layer.
In the daylight layer I’m a cofounder of Wistkey, and a recurring headline goes like this: someone gets caught running an AI service through tens of thousands of fake accounts — one recent case involved around twenty-five thousand of them — to grind out millions of interactions. It sounds sophisticated. Mostly it’s the same old trick at a new scale, and the scale is what gives it away.
Real players are messy. A crowd that moves in perfect sync isn’t a crowd — it’s one operator wearing a lot of hats.
What “abuse at scale” actually is
You don’t break into these systems so much as flood them with fake front doors. The common shapes:
- Account farming — thousands of sign-ups, often on free tiers, so one operator looks like a whole city of separate users.
- Reselling access — quietly renting out a paid AI through those accounts to people who can’t or won’t pay for it directly.
- Content floods — generating fake reviews, spam, or propaganda in volumes no human team could.
- Prodding for weaknesses — hammering the system with variations to find one prompt that slips past its guardrails.
How they get caught
The irony is that faking a person is easy, but faking twenty-five thousand different people is very hard. The mask slips in the aggregate:
- Behavior is too uniform. Real usage is lumpy and weird; bot fleets are suspiciously regular in timing, phrasing, and volume.
- The plumbing repeats. Thousands of “separate” accounts sharing infrastructure, payment quirks, or sign-up patterns cluster together under inspection.
- The rhythm is inhuman. Nobody sleeps, nobody pauses, requests arrive around the clock at machine cadence.
- Honeypots and rate limits catch the ones probing for weaknesses long before the crowd gets useful.
Why it matters if you're not the target
This isn’t just a platform’s problem. It leaks into everyone’s experience:
- The fake-review and spam floods you already distrust are increasingly this — part of why AI now has to say it’s AI.
- Abuse is why free tiers get stingier and sign-ups get more annoying — you’re paying, in friction, for other people’s bot farms.
- If you run anything with a login, assume the same pressure: watch patterns in aggregate, not just individual accounts, because that’s where the mask slips.
The reassuring part, if you squint, is that scale cuts both ways. The thing that makes these operations powerful — sheer numbers — is the exact thing that makes them visible. One fake player can hide forever. Twenty-five thousand of them, all walking in step, might as well be holding a sign. I read the crowd, not the costume. So does anyone good at catching them.
