Okta researchers Jeremy Kirk and Mathew Woodyard identified Poison Claude, an underground service selling access to Anthropic's Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6 at 5-15% of official per-token pricing. The service works as a gateway proxy: customers pay in cryptocurrency, receive an API key for an Anthropic-compatible endpoint, and set environment variables so their development tooling — Claude Code, for instance — routes requests through Poison Claude instead of Anthropic. Every prompt passes through the operator's infrastructure before reaching the model. (Source: The Hacker News)
That routing is the core problem. If a developer on your team wires this into their workflow, source code, internal architecture notes, customer data, and API credentials pasted into prompts all traverse a system controlled by an anonymous operator.
"When services are configured as a gateway proxy, the service provider has full visibility into prompts, as those prompts must be forwarded to a model," Okta said. "This is a privacy concern, as the service provider could accidentally leak or sell data."
The discount comes from stolen or fraudulently obtained accounts. Poison Claude's own site explains the mechanism: the operator harvests free bonus credits — the site cites the US$100 AWS bonus for Bedrock accounts — and pools those accounts, routing each customer request through one at random. Your usage is billed against someone else's compromised or abused cloud tenancy.
A configuration error briefly exposed the service's api.claudeopus[.]shop/api/status endpoint, which returned 881 total users and 872 active users before the exposure was fixed. The primary domain, poison-claude.bitsender[.]top, sits behind Cloudflare's CDN to hide its origin IP; Cloudflare has since placed a phishing warning on the main site but appears to have declined action on the API domain, which uses Turnstile for bot protection.
Okta counted more than half a dozen similar advertisements across cybercrime forums and messaging platforms, so this is not a single rogue operator but a small market.
Attack Chain: How Poison Claude Compromises Credentials and Intercepts Prompts
The economics of Poison Claude rest on credentials the operator never paid for. Advertisements for the service describe how it sources cheap tokens: by taking advantage of free bonus credits, including the US$100 bonus credit on AWS for Bedrock accounts. Those accounts are added to a pool, and each incoming request is routed to one of them silently — the service's own site states that "you don't see this."
That pooling model maps cleanly to Valid Accounts (T1078) and account creation at scale (T1585.003). The billing exposure lands on whoever owns the cloud account behind the credential, and the token spend appears as legitimate model inference under an authorized identity.
Supplying that pool requires a steady stream of new signups. Okta's research points to bad actors abusing free trials offered by AI services to facilitate synthetic identity creation at scale, using disposable email domains including dakaka[.]org, emailinbo[.]live, and ratixq[.]com. These are the registration-side indicators — a burst of trial accounts sharing one of these mail domains is the front end of a token-resale pool, not organic user growth.
Registration traffic is also laundered through residential proxies, which route signups through consumer IP connections that carry little or no history of malicious activity. Okta notes this makes blocking risky, since the same address ranges serve real customers. For a provider running abuse detection, geolocation and ASN reputation stop being useful discriminators.
The service's infrastructure was mapped through a configuration error. The API endpoint api.claudeopus[.]shop/api/status was exposed and returned live user counts before being fixed.
The main domain, poison-claude.bitsender[.]top, sits behind Cloudflare's CDN to conceal its originating IP. After responsible disclosure, Cloudflare placed a phishing warning in front of the main site but appears to have declined to act on the API domain, which uses Cloudflare Turnstile for bot protection. The delivery path stayed up while the storefront was flagged — treat the API hostname, not the marketing domain, as the operational indicator in egress logs.
Ecomagent.in runs the same play in the gray market with an estimated 970 users, selling discounted access to Opus 4.8, Opus 4.6, Sonnet 4.6, and OpenAI's GPT Codex 5.5 through a custom API endpoint. Multi-vendor resale means a single relay can intercept prompts intended for two different model providers, and a developer switching vendors does not escape the interception.
Two failure modes sit inside the relay itself. Model providers may cut off access to fraudulent accounts, which ends service without warning mid-project. Service providers may also advertise a frontier model and quietly return output from a cheaper, less capable one — the customer has no way to verify which model actually answered.
Demand is driven in part by a growing Chinese market for U.S. LLMs that are explicitly banned, as with ChatGPT, or unreachable behind the Great Firewall. API relay and proxy platforms give local developers a path to those models. Anthropic earlier this year accused DeepSeek, Moonshot AI, and MiniMax of running "industrial-scale campaigns" to illegally extract Claude's capabilities to improve their own models, and Reuters reported last week that Chinese military researchers have used OpenAI and Anthropic models to train domestic systems for defense purposes.
The interception works because nothing on the client side changes. Your development tooling behaves normally, responses come back in the expected format, and there is no error, latency signal, or certificate warning to indicate a third party read the prompt in transit. Source code, internal architecture notes, and credentials pasted into a prompt all pass through operator-controlled infrastructure that could leak or sell the data.
Business and Compliance Impact: Exposed Proprietary Data and Credential Liability
Okta's researchers found the service's status endpoint exposed before it was fixed, and it reported 881 total users with 872 active. That is a rough headcount of the people funneling prompts through an operator whose identity and hosting origin are hidden behind a CDN. If one of those accounts belongs to a developer in your organization, every prompt they submitted is in someone else's log.
Think about what your teams actually put into a model. Internal code that hasn't shipped, contract language, incident write-ups, customer records pasted in for summarization, financial models, merger analysis. When that content routes through a third-party proxy, the operator has full visibility into it, and Okta's assessment is direct: the provider could accidentally leak or sell that data.
The buyer-side risk is not limited to disclosure. Okta notes that model providers may cut off access to fraudulent accounts, and that service providers may advertise a frontier model while quietly serving something cheaper and less capable. Your engineer believes they are getting Opus-quality output for pennies; what comes back may be a different model entirely, which means the code review, the security analysis, or the compliance summary your team relied on was produced by something you cannot identify or audit.
The compliance exposure is where this gets expensive for you:
- Unauthorized subprocessor. Your customer contracts and privacy notices name the vendors permitted to process data. A cryptocurrency-funded proxy hidden behind Cloudflare is not on that list, and you cannot produce a DPA, a security questionnaire, or a breach notification contact for it.
- SOC 2 and vendor management. Shadow AI spending bypasses procurement entirely, so your vendor inventory is wrong. An auditor who finds unapproved model access in expense reports or environment variables has an exception in your vendor risk and change management controls.
- Data residency. You have no visibility into where the proxy's pooled accounts sit or which jurisdiction the traffic transits. If you have committed to regional processing for EU or healthcare customers, you cannot evidence that commitment.
- Regulated data. PII, protected health information, and cardholder or financial data submitted through an unauthorized intermediary is disclosure to an unknown party, with the notification obligations that follow.
There is also a terms-of-service problem attached to the individual. Buying resold access built on other people's cloud credits puts your organization on the wrong side of the model provider's acceptable use terms, and the accounts involved are the ones providers suspend. Losing legitimate API access mid-project is a delivery problem for you; explaining to a customer why their data reached an underground reseller is a contractual one.
Context matters for who might be reading the prompts. Anthropic has accused DeepSeek, Moonshot AI, and MiniMax of industrial-scale campaigns to extract Claude's capabilities, and Reuters reported that Chinese military researchers have used OpenAI and Anthropic models to train domestic systems. Proprietary prompt content has demonstrated value to parties collecting model outputs at scale.
The practical calculation for you is straightforward: the savings on token costs are measured in cents, and the exposure is measured in whatever your most sensitive internal document is worth.
Detection and Immediate Response: Identifying Compromised Claude Usage
First hours: find out whether traffic is leaving your tenant
Start by pulling your Anthropic Console usage and audit logs and comparing request volume per API key against what your teams actually run. A key that suddenly serves requests around the clock, or shows token consumption that does not match your developers' working hours, is the clearest early signal that the key is being pooled by someone else.
Then check egress. Any request to a Claude-compatible endpoint that is not an Anthropic-owned host is worth an immediate look, because the whole resale model depends on client tooling being pointed at a substitute base URL.
- Search proxy, DNS, and firewall logs for
api.claudeopus[.]shop,poison-claude.bitsender[.]top, andecomagent[.]in— the last of these is a separate gray-market relay reselling Opus 4.8, Opus 4.6, Sonnet 4.6, and OpenAI's GPT Codex 5.5 to an estimated 970 users. - Query developer endpoints and CI/CD runners for environment variables that redirect the Anthropic API base URL to a third-party host, plus any
.envor shell profile files containing the same override. - Flag cryptocurrency payment activity on corporate cards or expense claims tied to "cheap AI access," since these relays take crypto only.
If a key looks pooled, contact Anthropic directly to report suspected credential misuse and request revocation. Do not wait for the billing cycle to confirm it — the charges land on your cloud account, not the operator's.
24 to 48 hours: rotate, scope, and measure what was exposed
Rotate every Claude and Bedrock API key your organization holds, including keys embedded in build pipelines and container images. Rotation is the only reliable containment step, because a relay operator holding a valid key needs no further access to keep billing you.
Next, scope the prompt exposure. Pull the request history for each affected key and classify what was sent: source code, customer records, credentials pasted into a debugging prompt, contract text. That classification determines your breach-notification position, and it is far easier to do while logs are still within retention.
Also review your identity provider for accounts created against free AI trials using throwaway domains. Okta observed disposable domains including dakaka[.]org, emailinbo[.]live, and ratixq[.]com being used for synthetic identity creation at scale. In environments Capstone manages, Adlumin ITDR correlates these registration patterns and off-hours authentication anomalies against your normal identity baseline, which surfaces pooled or shared credentials before the billing does.
Ongoing controls
Move to short-lived API keys scoped per project, with IP allowlisting so a key stolen from a laptop cannot be replayed from a hosting provider's range. Rate limits per key give you a second signal: a pooled key hits the ceiling quickly, and the alert reaches you before the invoice does.
Enforce MFA on all Anthropic and cloud provider console accounts, and feed AI API telemetry into your SIEM alongside VPN and SaaS logs. Useful alert conditions include token spend deviating from a rolling seven-day baseline, requests from autonomous systems you have never used, and any model name in your logs that your teams are not licensed for.
One detection caveat: bot operators increasingly route through residential proxies, so source IP reputation alone will miss them. Behavioral signals — spend velocity, request timing, and model mix — hold up better than IP blocklists. Pair that with a written policy naming the approved AI endpoints, so an engineer chasing cheaper tokens has an authorized route to ask instead.
Securing Claude API Usage Against Credential Abuse and Prompt Theft
The first control to put in place is removing API keys from anywhere a developer can copy them by hand. Keys checked into a repository, pasted into a Dockerfile, or hardcoded in a client-side bundle can be lifted and pooled by anyone with read access, and the resale market described here runs on exactly that kind of loose credential. Store them in AWS Secrets Manager or HashiCorp Vault, inject them at runtime through environment variables the application reads once, and rotate on a fixed schedule so a leaked key has a short useful life.
Pair that with spend controls on the cloud accounts that back your model access. Set billing alerts and hard budget caps on any AWS account with Bedrock enabled, including sandbox and trial accounts your teams spin up for testing. Unmonitored trial accounts are the exact supply the gray market draws from, and a cap turns an unnoticed month of someone else's inference into a same-day alert.
Next, put every model request behind a single approved egress path. Run an API gateway or forward proxy that all application and developer traffic to LLM endpoints must traverse, and allowlist Anthropic-owned hosts at that gateway. Anything pointed at a custom Anthropic-compatible endpoint fails to resolve instead of quietly succeeding, which is what makes a proxy reseller usable in the first place.
Use that same chokepoint for content inspection. Define data classification rules that flag or block prompts carrying PII, cardholder data, health records, source code from restricted repositories, or contract and M&A language before the request leaves your network:
- Block outright for regulated categories under HIPAA, PCI DSS, or GDPR scope.
- Flag and log for review where trade secrets or unreleased code are likely.
- Record which key, which user, and which application submitted each classified prompt so you can scope an incident without guesswork.
On the endpoint side, the config change that redirects a developer's tooling is a local one — a shell profile edit, an unsanctioned CLI install, an environment variable set on a laptop outside your build pipeline. SentinelOne flags that unauthorized tooling and the process behavior around it across managed environments, before the workstation starts shipping prompts to an operator you cannot identify.
Then handle the human side, because most of this starts with a developer looking for cheaper tokens. Make it explicit in policy and in onboarding that model access is purchased through the official Anthropic Console and billing only, and that discounted third-party access is not a procurement shortcut. Okta's research identifies Ecomagent.in, estimated at nearly 970 users, advertising discounted Opus 4.8, Opus 4.6, Sonnet 4.6 and OpenAI's GPT Codex 5.5 through a custom endpoint — the same gateway-proxy design, marketed as a gray-market convenience.
Two more points worth putting in front of your engineers. Services that advertise a frontier model can silently serve a cheaper, less capable one, so the code review or analysis your team trusts may not have come from the model they paid for. And providers cut off fraudulent accounts without notice, which means a build pipeline wired to a reseller breaks mid-sprint.
Finally, treat free-trial abuse as a signal in your own signup flows. Okta documented bad actors creating synthetic identities at scale using disposable domains including dakaka[.]org, emailinbo[.]live, and ratixq[.]com, with residential proxies masking the traffic behind ordinary consumer IPs. Blocklist disposable email domains at registration and score signups on behavior rather than IP reputation alone.
What to Do Now: Priority Actions for Organizations Using Claude
Poison Claude is one storefront in a market, not a single site. Okta's researchers counted more than half a dozen advertisements for illegal AI model access across underground forums and messaging platforms, and one gray-market peer, Ecomagent.in, is estimated at nearly 970 users while offering Opus 4.8, Opus 4.6, Sonnet 4.6 and OpenAI's GPT Codex 5.5 through its own custom endpoint. Blocking one hostname does not close the category for you.
Takedowns are also partial. After responsible disclosure, Cloudflare placed a phishing warning in front of the main domain but appears to have declined to act on the API domain, which sits behind Cloudflare Turnstile for bot protection. The path your developer tooling would actually talk to stayed reachable, which means the outcome depends on your own credential hygiene rather than on someone else's enforcement.
There is a second-order point worth carrying to your engineering leads. Okta notes that customers of these services may be sold a frontier model and delivered a cheaper, less capable one, and that model providers can cut off fraudulent accounts without notice. Work produced through a resale endpoint is therefore of uncertain provenance and uncertain availability.
Residential proxies allow malicious traffic to come from benign consumer IP connections with often little or no history of malicious activity, making it risky to block.
That same supply chain feeds free-trial abuse, with disposable domains such as dakaka[.]org, emailinbo[.]live and ratixq[.]com used to create synthetic identities at scale. The decisive question for your organization is narrow: does any Anthropic credential you own serve traffic your teams did not originate. Your usage records answer it.
