Chinese grey market sells Claude API access at 90% off by using stolen credentials, model substitution, and harvesting users' prompts and outputs for resale as AI training data — 'transfer stations' operate through proxy networks that harvest user data
Researchers find proxy services discreetly swap AI models and log everything.
A grey-market economy of API proxy services in China is reselling access to Anthropic's Claude models at as little as 10% of the official price, according to an investigation published Monday by Oxford China Policy Lab researcher Zilan Qian.
The proxy networks, known in Chinese developer communities as "transfer stations," operate openly on platforms including GitHub, Taobao, and Telegram, and sustain their rock-bottom pricing through a combination of stolen credentials, model substitution, and harvesting users' prompts and outputs for resale as AI training data.
These findings give credence to the warnings issued in recent weeks by both the White House and Anthropic, the former of which accused Chinese entities in late April of running “industrial-scale” distillation campaigns against U.S. frontier models using tens of thousands of proxy accounts. Anthropic disclosed similar activity in February, identifying roughly 24,000 fraudulent accounts linked to Chinese labs, including DeepSeek, Moonshot AI, and MiniMax.
Qian's research describes a modular supply chain where most participants handle only one or two links. Upstream operators bulk-register Anthropic accounts by farming free API credits, exploiting corporate discounts, or subdividing $200 Max subscription plans across dozens of users. Some accounts enter the pool at zero cost, purchased with stolen credit card details, according to Qian.
To defeat Anthropic's newest identity verification requirements, which now include photo ID and live selfie checks for some users, the supply chain has recruited real people in lower-income countries to complete verification in person, Qian reported. The Worldcoin biometric black market, where iris scans harvested in Cambodia and Kenya were sold for under $30, provided a template for this approach.
German researchers at the CISPA Helmholtz Center for Information Security audited 17 of these proxy services and found widespread model substitution. Proxy access marketed as "Gemini-2.5" scored just 37% on a medical benchmark where the official API scored nearly 84%, according to the paper. Users requesting Claude Opus may instead receive responses from cheaper models such as Sonnet, Haiku, or even domestic Chinese alternatives like Qwen, with the output fraudulently relabeled.
The proxy operators also collect every prompt and response that passes through their servers. For coding agents, that means complete reasoning chains, repository context, and human-verified outputs, with several Chinese developers telling Qian that the access markup is essentially customer acquisition, and that harvesting those logs is the actual business. Datasets of Claude Opus 4.6 reasoning outputs with no clear provenance already circulate on HuggingFace.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
Proxy-harvested reasoning data is incredibly valuable for distillation because reasoning outputs can be systematically captured and used to train competing models. Proxy servers offer the same pipeline at lower effort, because paying customers generate the training data voluntarily.
But potential security exposure extends beyond model training because coding agents routinely pass the likes of contextual repo data, API structures, and authentication logic through to the model. Developers routing that traffic through an unvetted proxy are essentially sending proprietary source code to a third-party server with no data-handling obligations. Samsung encountered a version of this problem in 2023 when its fab engineers pasted proprietary source code into ChatGPT, inadvertently disclosing confidential semiconductor manufacturing data to OpenAI's servers. Proxy services create the same category of risk, but without even the baseline terms of service that major AI providers have.
Anthropic blocked Chinese-controlled entities from Claude access in September and has since added progressively stricter verification, but Qian's research suggests each new control has generated a corresponding evasion market rather than reducing overall unauthorized access.
Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.
Luke James is a freelance writer and journalist. Although his background is in legal, he has a personal interest in all things tech, especially hardware and microelectronics, and anything regulatory.
-
evilpaul All the American companies are running distillation "attacks" on each other and on the Chinese companies.Reply -
JK__ Here comes the propaganda campaign against Chinese AI. Anyone with an inkling of how model training works knows Chinese top models can't be trained to that level if it's distillation. And have you actually read any of Deepseek's and others' research papers? These are real innovations they are making, given to everyone for free too. And you can literally download their whole model for free and host on your own hardware and not send prompt anywhere.Reply
I don't understand how a third-party - true or not - substituting models in a service is any indication on the Chinese models themselves. I've seen western service that send your prompt to different model for you, it's not some controversial practice by itself. Whatever they may have done to get more western API time for their service is no proof that any models use that to train. The amount of API access needed to train even a decent distillation that way is enormous, there is no way signing up new users for free trial is enough - if it works at all, that's not how real distillation works in the first place. The authors are deliberately conflating what a third-party service does with what models do, implying that all Chinese does is switcharoo. As said before, you can host the Chinese models on your own computer, no need to send prompt or private info anywhere.
The western AI companies are getting desperate over the Chinese competition, and responds in the only way Americans know how to deal with competition: by kneecapping the opponent. It's been reported they've allocated huge sums for defamation campaign against Chinese AI in tandem with the US government's accusations. I guess we now know where part of that fund went. -
lomando Old news. Back in the days westerners does this stolen credential proxies too. Look up storm 2139, it (was) one of many reverse proxies giving access to stolen API key. It was free for years before Microsoft and Amazon clamped down the operation and now they operates in paid subscription or weird discord ritual.Reply -
Pierce2623 ReplyJK__ said:Here comes the propaganda campaign against Chinese AI. Anyone with an inkling of how model training works knows Chinese top models can't be trained to that level if it's distillation. And have you actually read any of Deepseek's and others' research papers? These are real innovations they are making, given to everyone for free too. And you can literally download their whole model for free and host on your own hardware and not send prompt anywhere.
I don't understand how a third-party - true or not - substituting models in a service is any indication on the Chinese models themselves. I've seen western service that send your prompt to different model for you, it's not some controversial practice by itself. Whatever they may have done to get more western API time for their service is no proof that any models use that to train. The amount of API access needed to train even a decent distillation that way is enormous, there is no way signing up new users for free trial is enough - if it works at all, that's not how real distillation works in the first place. The authors are deliberately conflating what a third-party service does with what models do, implying that all Chinese does is switcharoo. As said before, you can host the Chinese models on your own computer, no need to send prompt or private info anywhere.
The western AI companies are getting desperate over the Chinese competition, and responds in the only way Americans know how to deal with competition: by kneecapping the opponent. It's been reported they've allocated huge sums for defamation campaign against Chinese AI in tandem with the US government's accusations. I guess we now know where part of that fund went.
How is a story just listing off facts without giving an opinion propaganda? As far as “distillation” goes Deepseek “distilled” gpt3.5 so hard for one of their releases that if you asked it to qualitatively compare itself to gpt3.5 it would literally say “i dont understand i am ChatGPT3.5”.JK__ said:Here comes the propaganda campaign against Chinese AI. Anyone with an inkling of how model training works knows Chinese top models can't be trained to that level if it's distillation. And have you actually read any of Deepseek's and others' research papers? These are real innovations they are making, given to everyone for free too. And you can literally download their whole model for free and host on your own hardware and not send prompt anywhere.
I don't understand how a third-party - true or not - substituting models in a service is any indication on the Chinese models themselves. I've seen western service that send your prompt to different model for you, it's not some controversial practice by itself. Whatever they may have done to get more western API time for their service is no proof that any models use that to train. The amount of API access needed to train even a decent distillation that way is enormous, there is no way signing up new users for free trial is enough - if it works at all, that's not how real distillation works in the first place. The authors are deliberately conflating what a third-party service does with what models do, implying that all Chinese does is switcharoo. As said before, you can host the Chinese models on your own computer, no need to send prompt or private info anywhere.
The western AI companies are getting desperate over the Chinese competition, and responds in the only way Americans know how to deal with competition: by kneecapping the opponent. It's been reported they've allocated huge sums for defamation campaign against Chinese AI in tandem with the US government's accusations. I guess we now know where part of that fund went.