Overview: The Peril of Discounted AI Model Access
Cybersecurity researchers have identified a growing number of services operating on underground cybercrime forums and messaging platforms that offer illicit and discounted access to artificial intelligence (AI) models. One such prominent service, dubbed Poison Claude, purports to provide access to Anthropic’s large language models (LLMs), including Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6. While seemingly offering a cost-effective alternative to official channels, these services carry substantial privacy and security risks, primarily the interception and potential sale of user prompts, as highlighted in an analysis by Okta researchers Jeremy Kirk and Mathew Woodyard.
Technical Details and Analysis: How Proxy Services Intercept AI Prompts
Poison Claude’s operational model leverages free bonus credits, such as the US$100 bonus credit available for Bedrock accounts on AWS, to offer AI model access at a fraction of the official per-token price. The service explicitly states its method: “We add those accounts to our pool, your request is routed to a specific account under the hood (you don’t see this), and you get charged 5-15% of the official per-token price depending on the model.” Payments are accepted in cryptocurrencies, after which customers receive an Anthropic-compatible API key and instructions to configure their development environment to route requests through Poison Claude’s API instead of Anthropic’s directly. This mechanism inherently grants the service provider full visibility into all prompts entered by the customer, creating a significant privacy concern.
This incident highlights how proxy services intercept AI prompts, meaning any data sent to the LLM via Poison Claude is accessible to the service operator. Okta researchers noted, “When services are configured as a gateway proxy, the service provider has full visibility into prompts, as those prompts must be forwarded to a model.” This level of access raises the possibility of accidental data leakage or deliberate sale of sensitive information.
A configuration error on Poison Claude’s API, specifically the api.claudeopus[.]shop/api/status endpoint, temporarily exposed operational metrics, revealing 881 total users and 872 active users at the time of discovery. This endpoint exposure has since been remediated. The primary domain, poison-claude.bitsender[.]top, uses Cloudflare’s CDN for IP obfuscation. Following responsible disclosure, Cloudflare issued a phishing warning for the main site but reportedly declined action on the API domain. Another similar gray-market service, Ecomagent.in, is estimated to have approximately 970 users and offers discounted access to Anthropic models and OpenAI’s GPT Codex 5.5 through its custom API.
Beyond cost savings, users may seek such services due to access restrictions or perceived anonymity. However, these benefits are outweighed by risks, including model providers cutting off fraudulent accounts, service providers delivering inferior models, and critically, the risk of AI prompt interception and data exposure. The broader context of this threat includes a growing Chinese market for U.S.-based LLMs, where services offer API relay platforms to circumvent geographic restrictions. Furthermore, malicious actors are abusing free trials from legitimate AI services to facilitate synthetic identity creation at scale, often employing disposable domains.
Actionable Recommendations and Mitigations
To safeguard sensitive information and ensure secure AI model interactions, security professionals and users should prioritize the following:
- Avoid Unauthorized Proxy Services: Under no circumstances should sensitive or proprietary data be routed through unofficial third-party API proxy services like Poison Claude. The cost savings do not justify the severe privacy and security risks. For organizations concerned about securing Anthropic LLM access, direct API usage is the most secure method.
- Prioritize Direct API Access: Whenever possible, interact directly with official AI model providers’ APIs. This ensures that prompts are handled according to the provider’s security and privacy policies, eliminating the intermediary risk.
- Review Terms of Service and Privacy Policies: Before integrating any AI service, thoroughly review its terms of service and privacy policies to understand how data is handled, stored, and protected.
- Implement Data Minimization: Limit the amount of sensitive information included in prompts sent to any LLM, regardless of the access method. This reduces the attack surface if data is compromised.
- Monitor for Anomalous API Usage: Organizations should monitor their AI model API usage for any unusual activity, such as traffic spikes or access from unexpected IP addresses, which could indicate unauthorized access or misuse of API keys.
By adhering to these recommendations, defenders can significantly mitigate the privacy and security risks associated with third-party AI proxy services and ensure the integrity of their AI-driven operations.
Related: Claude Cowork Sandbox Escape: VM to macOS File Access, Securing Generative AI Adoption: Enterprise Governance Frameworks