Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt
Underground services like "Poison Claude" sell discounted access to Anthropic's LLMs by pooling fraudulently obtained free-tier accounts, charging users 5-15% of official per-token prices These proxy/gateway services give operators full visibility into customer prompts, creating serious privacy and data leakage risks Okta researchers identified at least six such services with hundreds of active users, exploiting free bonus credits (e.g., AWS Bedrock's $100 credit) through synthetic identity crea
Analysis
TL;DR
- Underground services like "Poison Claude" sell discounted access to Anthropic's LLMs by pooling fraudulently obtained free-tier accounts, charging users 5-15% of official per-token prices
- These proxy/gateway services give operators full visibility into customer prompts, creating serious privacy and data leakage risks
- Okta researchers identified at least six such services with hundreds of active users, exploiting free bonus credits (e.g., AWS Bedrock's $100 credit) through synthetic identity creation at scale
- Bad actors increasingly use disposable domains and residential proxies to evade bot detection, compounding the threat as AI agent deployments grow
- The gray market for U.S. LLM access is expanding, particularly in China, where models are banned or blocked by the Great Firewall
Why It Matters
This reveals a growing underground economy that undermines AI model providers' security and billing models while exposing users to significant privacy risks. For AI practitioners, it highlights the dangers of using unauthorized API proxies and the importance of securing internal AI tooling configurations. The trend also signals escalating identity fraud and bot activity tied to AI agent proliferation.
Technical Details
- Poison Claude operates as an API gateway proxy: customers receive an Anthropic-compatible API key and environment variable instructions to route requests through Poison Claude's infrastructure instead of directly to Anthropic, which then forwards prompts to pooled fraudulent accounts
- The service exploits free-tier bonus credits (e.g., AWS Bedrock's $100 credit for new accounts) created at scale using disposable email domains such as dakaka.org, emailinbo.live, and ratixq.com
- A misconfigured endpoint (api.claudeopus[.]shop/api/status) temporarily exposed user metrics showing 881 total and 872 active users before being patched
- The primary domain (poison-claude.bitsender[.]top) is hidden behind Cloudflare CDN, while the API domain uses Cloudflare Turnstile for bot protection; Cloudflare added a phishing warning but declined to take down the API domain
- A similar gray-market service, Ecomagent.in, claims ~970 users and offers discounted access to both Anthropic (Opus 4.8, Opus 4.6, Sonnet 4.6) and OpenAI (GPT Codex 5.5) models via a custom API endpoint
- Residential proxies are increasingly used to mask malicious traffic behind benign consumer IPs, making detection and blocking significantly harder for providers
Industry Insight
- AI model providers must treat API key abuse and synthetic identity creation as critical threats, investing in stronger identity verification, behavioral anomaly detection, and rate-limiting strategies tailored to AI workloads
- Organizations using AI development tools (e.g., Claude Code) should audit their environment configurations and API endpoints to prevent accidental routing through unauthorized proxy services that could exfiltrate proprietary prompts
- The rise of AI-driven bot networks and residential proxy abuse suggests a need for updated bot mitigation frameworks that account for AI agent traffic patterns, rather than relying solely on traditional web bot detection methods
Disclaimer: The above content is generated by AI and is for reference only.