Chinese grey market sells Claude API access at 90% off by using stolen credentials, model substitution, and harvesting users’ prompts and outputs for resale as AI training data — ‘transfer stations’ operate through proxy networks that harvest user data

A grey-market economy of API proxy services in China is reselling access to Anthropic’s Claude models at as little as 10% of the official price, according to an investigation published Monday by Oxford China Policy Lab researcher Zilan Qian.

The proxy networks, known in Chinese developer communities as “transfer stations,” operate openly on platforms including GitHub, Taobao, and Telegram, and sustain their rock-bottom pricing through a combination of stolen credentials, model substitution, and harvesting users’ prompts and outputs for resale as AI training data.

These findings give credence to the warnings issued in recent weeks by both the White House and Anthropic, the former of which accused Chinese entities in late April of running “industrial-scale” distillation campaigns against U.S. frontier models using tens of thousands of proxy accounts. Anthropic disclosed similar activity in February, identifying roughly 24,000 fraudulent accounts linked to Chinese labs, including DeepSeek, Moonshot AI, and MiniMax.

Latest Videos From

You may like

Qian’s research describes a modular supply chain where most participants handle only one or two links. Upstream operators bulk-register Anthropic accounts by farming free API credits, exploiting corporate discounts, or subdividing $200 Max subscription plans across dozens of users. Some accounts enter the pool at zero cost, purchased with stolen credit card details, according to Qian.

To defeat Anthropic’s newest identity verification requirements, which now include photo ID and live selfie checks for some users, the supply chain has recruited real people in lower-income countries to complete verification in person, Qian reported. The Worldcoin biometric black market, where iris scans harvested in Cambodia and Kenya were sold for under $30, provided a template for this approach.

German researchers at the CISPA Helmholtz Center for Information Security audited 17 of these proxy services and found widespread model substitution. Proxy access marketed as “Gemini-2.5” scored just 37% on a medical benchmark where the official API scored nearly 84%, according to the paper. Users requesting Claude Opus may instead receive responses from cheaper models such as Sonnet, Haiku, or even domestic Chinese alternatives like Qwen, with the output fraudulently relabeled.

The proxy operators also collect every prompt and response that passes through their servers. For coding agents, that means complete reasoning chains, repository context, and human-verified outputs, with several Chinese developers telling Qian that the access markup is essentially customer acquisition, and that harvesting those logs is the actual business. Datasets of Claude Opus 4.6 reasoning outputs with no clear provenance already circulate on HuggingFace.

Get Tom’s Hardware’s best news and in-depth reviews, straight to your inbox.

Proxy-harvested reasoning data is incredibly valuable for distillation because reasoning outputs can be systematically captured and used to train competing models. Proxy servers offer the same pipeline at lower effort, because paying customers generate the training data voluntarily.

But potential security exposure extends beyond model training because coding agents routinely pass the likes of contextual repo data, API structures, and authentication logic through to the model. Developers routing that traffic through an unvetted proxy are essentially sending proprietary source code to a third-party server with no data-handling obligations. Samsung encountered a version of this problem in 2023 when its fab engineers pasted proprietary source code into ChatGPT, inadvertently disclosing confidential semiconductor manufacturing data to OpenAI’s servers. Proxy services create the same category of risk, but without even the baseline terms of service that major AI providers have.

Anthropic blocked Chinese-controlled entities from Claude access in September and has since added progressively stricter verification, but Qian’s research suggests each new control has generated a corresponding evasion market rather than reducing overall unauthorized access.

Follow Tom’s Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.