Full Report
Cybersecurity researchers have discovered more than half-a-dozen services advertisements for illegal access to artificial intelligence (AI) models on underground cybercrime forums and messaging platforms. One such service, Poison Claude, claims to offer access to Anthropic's large language models (LLMs), including Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6. "Advertisements for Poison Claude
Analysis Summary
# Industry News: The Rise of "Poison Claude" and the AI Gray Market
## Summary
Cybersecurity researchers have identified a burgeoning underground market for discounted access to premium AI models, most notably a service dubbed "Poison Claude." By exploiting cloud provider credits and utilizing proxy APIs, these services offer frontier models like Anthropic’s Claude at a 85–95% discount while compromising user privacy and data security.
## Key Details
- **Date:** August 5, 2026
- **Companies Involved:** Anthropic (Targeted), Okta (Research lead), Cloudflare (Infrastructure), Amazon Web Services (Platform exploited)
- **Category:** Threat Intelligence / AI Security
## The Story
Okta’s threat intelligence team has exposed "Poison Claude," a service advertising illegal, cut-rate access to Anthropic’s latest LLM iterations (including Opus 4.8 and Sonnet 4.6). The service operates by harvesting $100 AWS Bedrock promotional credits via fraudulent or "throwaway" accounts, pooling them, and routing user requests through a custom API proxy.
The business model is built on massive price arbitrage: users pay via cryptocurrency for an API key that is compatible with standard development environments (like Claude Code), but their traffic is routed through the attacker’s infrastructure. Researchers discovered that a configuration error briefly exposed the service’s metrics, revealing nearly 900 active users. While Cloudflare has implemented phishing warnings on the main landing page, the underlying API infrastructure remains active.
## Business Impact
### For the Companies Involved
- **Anthropic:** Faces significant revenue leakage and potential brand dilution if "poisoned" or downgraded models are delivered under their name. They also face continued intellectual property risks from actors using these proxies to "distill" or steal model capabilities.
- **AWS:** Experiences financial loss through the systematic abuse of promotional credit programs, necessitating a likely tightening of "Free Tier" or "Startup Credit" verification processes.
### For Competitors
- **OpenAI & Google:** Likely targeted by similar proxy services (e.g., GPT Codex 5.5). The existence of these markets suggests that price and geographic availability remain the primary drivers for "shadow AI" adoption, challenging the official enterprise pricing models of major labs.
### For Customers
- **Privacy Risks:** Users of these services grant operators total visibility into their prompts. For developers, this means proprietary code or sensitive corporate data is being captured by malicious third parties.
- **Reliability:** Customers face sudden service outages as model providers identify and shutter the underlying fraudulent cloud accounts.
### For the Market
- **Geopolitics:** These services act as a "backdoor" for users in restricted regions (notably China) to bypass the Great Firewall and U.S. export controls, complicating international AI safety and compliance efforts.
## Technical Implications
The use of **API Gateway Proxies** is the core technical enabler here. By instructing users to change environment variables to point to a malicious endpoint (e.g., `api.claudeopus.shop`), attackers sit in a "Man-in-the-Middle" (MitM) position. This allows for prompt injection, data harvesting, and the potential delivery of lower-tier models disguised as premium "Opus" outputs.
## Strategic Analysis
- **Market Positioning:** This highlights a massive demand for "Uncensored" or "Off-Book" AI. The official providers are currently positioned as premium, secure, but expensive and regulated; the gray market is positioning itself on cost and anonymity.
- **Competitive Advantage:** Attackers are using **Residential Proxies** to blend in with legitimate consumer traffic, making it difficult for cloud providers to use traditional IP-based bot detection.
- **Challenges:** The primary obstacle for the AI industry is the "Credit Loophole." As long as cloud providers use high-value credits to attract startups, attackers will use synthetic identities to harvest those credits as a currency.
## Industry Reactions
- **Okta Researchers:** Emphasize that these services are not just about "cheap tokens" but are sophisticated data-harvesting operations.
- **Market Response:** There is growing pressure on CDN providers like Cloudflare to take more aggressive action against the API endpoints themselves, rather than just the front-end marketing sites.
## Future Outlook
- **Predictions:** Expect a "Verification Arms Race" where AWS, GCP, and Azure implement more stringent biometric or financial "Proof of Stake" requirements to claim AI credits.
- **What to Watch for:** The emergence of "Model Hijacking," where these proxies inject malicious code into the LLM’s responses before they reach the developer’s IDE.
## For Security Professionals
Practitioners should audit developer environments for unauthorized API endpoints. If an employee is using a tool like "Claude Code" but has modified the `BASE_URL` or environment variables to point to a non-standard domain, it should be treated as a high-severity data exfiltration incident. Monitoring for "Residential Proxy" traffic within corporate networks remains a priority.