Cybersecurity researchers have uncovered more than half a dozen illegal services hawking unauthorized access to artificial intelligence models on underground cybercrime forums and encrypted messaging platforms. A report published Tuesday by Okta reveals that one such service, Poison Claude, advertises access to Anthropic's large language models—including Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6—at a fraction of official prices. The research highlights a growing gray market where users can bypass official AI providers through proxy services that exploit free trial credits and promotional offers.
Poison Claude operates by exploiting free bonus credits, such as the $100 promotional credit offered on AWS for Bedrock accounts, according to the Okta analysis. The service openly states on its website that it aggregates these accounts into a shared pool, routing customer requests to individual accounts behind the scenes while charging just 5 to 15 percent of the official per-token cost depending on the model. A configuration error temporarily exposed the service's status endpoint, revealing 881 total users and 872 active users before the vulnerability was patched. A competing service, Ecomagent.in, is estimated to have approximately 970 users and advertises discounted access to both Anthropic's Opus and Sonnet models as well as OpenAI's GPT Codex 5.5. The main Poison Claude domain is hosted behind Cloudflare's content delivery network to hide its originating IP address, while the API domain uses Cloudflare Turnstile for bot protection.
Customers who pay via cryptocurrency receive an API key for an Anthropic-compatible interface and instructions to modify environment variables so their development tools route through Poison Claude's API instead of Anthropic's official endpoint. "When services are configured as a gateway proxy, the service provider has full visibility into prompts," the Okta researchers Jeremy Kirk and Mathew Woodyard write, noting that this creates privacy concerns because the service operator could accidentally leak or sell customer data. The report identifies several risks beyond privacy exposure: model providers may terminate access to fraudulent accounts without warning, and service operators could advertise access to a frontier model but actually deliver responses from a cheaper, less capable alternative.
The findings come as evidence mounts of bad actors abusing free trial offers from AI services to create synthetic identities at scale using disposable email domains. The report notes that bot activity is climbing across the internet, driven in part by increasing deployments of AI agents, and those running bot networks now have more options than ever to evade detection—including residential proxies that route malicious traffic through benign consumer IP connections with little or no history of suspicious behavior, making blocking risky. The research also highlights a thriving Chinese market for U.S.-based large language models that are either explicitly banned or inaccessible due to the Great Firewall, with API relay and proxy platforms enabling local developers to reach otherwise restricted models. Earlier this year, Anthropic accused three Chinese firms—DeepSeek, Moonshot AI, and MiniMax—of running industrial-scale campaigns to illegally extract Claude's capabilities to improve their own models, and last week Reuters reported that Chinese military researchers have used AI models from OpenAI and Anthropic to train domestic systems for defense purposes. Following responsible disclosure, Cloudflare placed a phishing warning on the Poison Claude site but declined to take action on the API domain. For organizations relying on AI models, the proliferation of unauthorized access points introduces both security and compliance challenges that conventional network controls may struggle to address.