Poison Claude Proxy Put Customer Prompts in Operator View
Okta researchers identified Poison Claude, an illicit service advertising discounted access to Anthropic large language models, including Opus 4.8, Opus 4.7, Opus 4.6 and Sonnet 4.6. The service said it charged 5% to 15% of official per-token prices, while a misconfigured API status endpoint exposed 881 total users and 872 active users. The endpoint has since been fixed.
Customers paid in cryptocurrency and received an API key compatible with Anthropic’s API. They were then instructed to set environment variables so that development tools such as Claude Code would send requests to Poison Claude rather than directly to Anthropic.
Cheap access is built on pooled accounts
Okta researchers Jeremy Kirk and Mathew Woodyard said Poison Claude advertised the use of free bonus credits, including the US$100 AWS bonus credit for Bedrock accounts. The operator said it added those accounts to a pool and routed each request to a selected account without showing that routing to the customer.
In this arrangement, prompts first reach the proxy and are then forwarded to Anthropic, with responses returned through the same route. That architecture gives the proxy operator full visibility into prompts because it must relay them to the underlying model.
The main Poison Claude domain was placed behind Cloudflare’s CDN, obscuring its origin IP address. Following responsible disclosure, Cloudflare added a phishing warning in front of the site. Okta said the API domain appeared to remain available and used Cloudflare Turnstile for bot protection.
Proxy use creates privacy and continuity risks
Okta warned that a gateway provider can accidentally leak or sell prompt data. Users also face the risk that fraudulent underlying accounts will be cut off, or that a service advertising a frontier model will provide a cheaper, less capable alternative instead.
Another service, Ecomagent.in, was estimated to have nearly 970 users. It claimed discounted API access to Anthropic’s Opus 4.8, Opus 4.6 and Sonnet 4.6, as well as OpenAI’s GPT Codex 5.5. Such offerings can appeal where price, access restrictions, privacy or anonymity matter, but the relay model places data and service reliability outside the model provider’s direct relationship with the user.
Growing demand also feeds abusive access patterns
The findings arrive amid a Chinese market for relay and proxy platforms providing access to U.S.-based LLMs that may be banned or inaccessible behind the Great Firewall. Anthropic earlier accused DeepSeek, Moonshot AI and MiniMax of industrial-scale efforts to extract Claude capabilities. The risks of AI access misuse also connect with exposed credentials used against Hugging Face, where exposed credentials were used against Hugging Face, showing how weak access controls can turn AI workflows into an attack path.
Okta also noted abuse of free AI-service trials for synthetic identity creation using disposable domains. For businesses, the practical implication is to keep sensitive prompts, source code and customer information on authorized endpoints, and validate API routing, account ownership and billing before connecting developer tools to an AI service.