Chinese grey market resells Claude API access at 90% discount using stolen credentials and data harvesting
A network of proxy services operating across GitHub, Taobao, and Telegram is selling access to Anthropic's Claude models at 10% of official pricing by exploiting stolen accounts, swapping models without disclosure, and harvesting user prompts for resale as training data, according to research published this week by Oxford China Policy Lab.
The services, called "transfer stations" in Chinese developer communities, operate a supply chain where upstream operators bulk-register Anthropic accounts using free API credits, corporate discounts, or stolen credit card details. Downstream resellers then mark up access and sell it through proxy networks.
How the supply chain defeats identity verification
Anthropic added photo ID and live selfie verification requirements to block unauthorized access. The supply chain responded by recruiting people in lower-income countries to complete verification checks in person for under $30 per account-a model borrowed from the Worldcoin biometric black market.
German researchers at CISPA Helmholtz Center audited 17 proxy services and found systematic model substitution. Services advertised as offering "Gemini-2.5" delivered a model that scored 37% on medical benchmarks where the official API scored 84%. Users requesting Claude Opus received cheaper alternatives like Sonnet or Chinese models such as Qwen, with outputs relabeled to match what customers paid for.
The real business: harvesting training data
Proxy operators log every prompt and response passing through their servers. For coding agents, this captures complete reasoning chains, repository context, and human-verified outputs.
Chinese developers told researchers the markup on API access is essentially customer acquisition. The actual revenue comes from selling harvested logs as training datasets. Datasets of Claude Opus 4.6 reasoning outputs with no clear source already circulate on HuggingFace.
Reasoning outputs are particularly valuable for model distillation-the process of training cheaper models to replicate expensive ones. Proxy servers automate this at zero cost since paying customers generate the training data themselves.
Security risk for corporate users
Coding agents often send proprietary source code, API structures, and authentication logic to AI models. Developers routing that traffic through unvetted proxies are sending confidential information to servers with no data-handling obligations or terms of service.
Samsung faced a similar problem in 2023 when engineers pasted semiconductor manufacturing data into ChatGPT, disclosing confidential fab information to OpenAI. Proxy services create identical exposure without even baseline contractual protections.
Verification measures breed evasion markets
Anthropic blocked Chinese-controlled entities from Claude access in September and progressively tightened verification since then. Research suggests each new control generates a corresponding evasion market rather than reducing overall unauthorized access.
The White House accused Chinese entities in late April of running "industrial-scale" distillation campaigns against U.S. frontier models using tens of thousands of proxy accounts. Anthropic identified roughly 24,000 fraudulent accounts linked to Chinese labs including DeepSeek, Moonshot AI, and MiniMax in February.
For marketers and teams using prompt engineering with AI APIs, the research underscores the importance of vetting which services handle your company's data and avoiding unauthorized proxy access regardless of cost savings.
Your membership also unlocks:
