More and more services offering “cheap” access to AI models are appearing under the radar. A recent case raising many questions is Poison Claude. Researchers explain how such a service presents itself as a route to large language models (LLMs), while simultaneously creating significant risks for privacy, integrity, and misuse.
What makes this especially urgent: these setups are not only about marketing or discounts. Through technical choices—such as API proxying and sharing prompts—the provider can potentially observe what users enter. Below you’ll find what the researchers uncovered, how it works in practice, and what you should watch out for.
What is Poison Claude?
Poison Claude is described by researchers as a service that sells ads and access for illegal—or at least questionable—distribution of AI model usage. On the underground market, the service is promoted as a way to use Anthropic LLMs, including variants such as Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6.
The core of the claim is price: customers would supposedly get tokens cheaper than the official rates. According to the analysis by Okta researchers (Jeremy Kirk and Mathew Woodyard), Poison Claude supports this with constructions around “free bonus credits,” for example a $100 bonus credit for AWS Bedrock accounts. After that, the service would add accounts to its own pool and forward the request to a specific account “under the hood.”
How the proxy works under the hood
After payment, Poison Claude provides an API key compatible with Anthropic’s API. Customers then need to configure their environment so that their development setup—such as Claude Code—does not connect to the official provider, but to the Poison Claude API.
The key security point is the data flow: prompts entered by users are passed as input from the Poison Claude API to Anthropic. The answers are then sent back in a similar way to the customer.
Because the system functions as a gateway or proxy, the provider can, in principle, see the prompts, according to Okta. That’s not only a privacy concern—it also increases the likelihood of errors, unwanted logging, or data leaks—especially when the service operates as an external intermediary layer.
From discounts to risk: bots, bypassing, and data leaks
Cheap AI access sounds attractive, but research points to multiple risk factors that often come together with these kinds of gray or illegal offerings.
- Service provider can observe: since prompts go through the gateway, there’s always an additional data-safety layer outside your direct control.
- Uncertainty about what actually runs: in theory, providers can deliver different models than advertised or pass along less capable variants under the same name.
- Vulnerabilities in configuration: with Poison Claude, an endpoint was “accidentally” exposed. It was a status page where counts of users (total and active) were visible. This exposure has since been fixed.
- Unreliable infrastructure and bypassing: the Poison Claude domain runs behind Cloudflare’s CDN to conceal its origin. For bot protection, the API uses the Cloudflare Turnstile domain name.
Researchers also report that, after responsible disclosure, Cloudflare placed a phishing warning on the main domain page. At the same time, it appears Cloudflare took “no action” on the API domain, where bot protection is present.
Identity and compliance: why this is broader
These findings fit into a broader trend: in certain markets, demand is growing for AI models that are locally restricted—due to regulation or technical blocks, for example. Research points to a Chinese market where access to American LLMs may be explicitly banned or difficult to reach due to restrictions.
In that same ecosystem, there are also proxy and relay platforms that help local developers still get access. On top of that, other misuse patterns appear: researchers link the rise of botnets to an increase in automated attacks and the use of bots that make traffic look like it comes from ordinary consumers via residential proxies.
With residential proxies, blocking is harder: IP addresses often have little or no history of malicious activity. That reduces the effectiveness of simple detection rules and increases the chance that harmful traffic slips through the cracks.
Ecomagent.in as a comparable example
In addition to Poison Claude, a similar service active in the gray market is mentioned: Ecomagent.in. The analysis estimates the service has nearly 970 users. Ecomagent.in also claims to offer discounted AI access, including Anthropic models such as Opus 4.8, Opus 4.6, and Sonnet 4.6, as well as OpenAI’s GPT Codex 5.5 via its own API endpoint.
The researchers emphasize that customers sometimes have multiple reasons to look at services like these—such as cost, limitations, or privacy needs. But that same intermediary layer brings inherent risks: you give up partial control over data flows and execution.
Why providers can see your data
Okta explains the principle simply: when services are set up as gateway proxies, the provider must forward the prompts to the model. As a result, in practice there is visibility into what is being entered.
This doesn’t automatically mean every prompt is “forwarded and sold.” However, the risk is structural: the service provider can leak data accidentally, process it incorrectly, or expose it through logging and monitoring. In addition, the less transparency there is—and the more dubious the origin—the smaller your chance of enforcing guarantees.
Additional tensions: industrial extraction and ongoing development
In the context of LLMs, other concerns also come into play. Earlier, Anthropic described allegations toward three Chinese firms—DeepSeek, Moonshot AI, and MiniMax—about large-scale campaigns to illegally extract Claude capabilities to improve models.
There’s also reporting that AI models from providers such as OpenAI and Anthropic are used in military research to train domestic AI systems. While this is not the same mechanism as Poison Claude, it shows that AI capabilities are the subject of industrial competition, bypassing, and abuse—and that cheap, unofficial access amplifies those risks.
How to recognize services like these (and what you can do)
Not every “discounted AI” provider is inherently malicious, but Poison Claude demonstrates how a proxy model can work and where the weak points are. To reduce the chance of harm, focus on these practical checks:
- Verify where your traffic goes: look at the domain and endpoint your app uses, and compare it with your intended provider.
- Assess the data flow: if you route prompts through a third party, you lose control over privacy and data management.
- Be alert to claims about “bonus tokens”: low prices based on constructions with credits can indicate that costs are driven by scaling and reusing accounts.
- Use monitoring and logging: detect unexpected outbound requests, unusual API calls, and anomalies in answer patterns.
- Plan an exit: if you depend on an external proxy, make it possible to switch to an official route quickly.
If you’re already working with a similar service, it’s wise to critically review what data you send and whether your prompts may contain sensitive information. In many scenarios, it’s safer to never use confidential input when you can’t verify end-to-end processing.
Conclusion: cheap is rarely risk-free
The research around Poison Claude shows how an apparently simple promise—cheap AI token access—can turn into a proxy setup with visibility into prompts. That increases privacy risks and makes you dependent on an external party that doesn’t offer the same safeguards as an official provider.
If you want to use AI safely, it helps to always ask with any pricing claim: what route does my data take, who sees the input, and what control do I have if something goes wrong? Strong policies and technical checks can prevent a lot of damage—especially as bots, bypassing, and gray-market services keep growing.
Related reading: SAFE guidelines for sharing AI incident data and context-aware AI security: CASB and DLP miss context.
Source: https://thehackernews.com/2026/08/poison-claude-sells-discounted-claude.html
