GoKawiilA grey-market economy of API proxy services in China is reselling access to Anthropic's Claude models at as little as 10% of the official price, according to an investigation published Monday by Oxford China Policy Lab researcher Zilan Qian.
The proxy networks, known in Chinese developer communities as "transfer stations," operate openly on platforms including GitHub, Taobao, and Telegram, and sustain their rock-bottom pricing through a combination of stolen credentials, model substitution, and harvesting users' prompts and outputs for resale as AI training data.
These findings give credence to the warnings issued in recent weeks by both the White House and Anthropic, the former of which accused Chinese entities in late April of running “industrial-scale” distillation campaigns against U.S. frontier models using tens of thousands of proxy accounts. Anthropic disclosed similar activity in February, identifying roughly 24,000 fraudulent accounts linked to Chinese labs, including DeepSeek, Moonshot AI, and MiniMax.
Latest Videos From
Qian's research describes a modular supply chain where most participants handle only one or two links. Upstream operators bulk-register Anthropic accounts by farming free API credits, exploiting corporate discounts, or subdividing $200 Max subscription plans across dozens of users. Some accounts enter the pool at zero cost, purchased with stolen credit card details, according to Qian.
To defeat Anthropic's newest identity verification requirements, which now include photo ID and live selfie checks for some users, the supply chain has recruited real people in lower-income countries to complete verification in person, Qian reported. The Worldcoin biometric black market, where iris scans harvested in Cambodia and Kenya were sold for under $30, provided a template for this approach.
German researchers at the CISPA Helmholtz Center for Information Security audited 17 of these proxy services and found widespread model substitution. Proxy access marketed as "Gemini-2.5" scored just 37% on a medical benchmark where the official API scored nearly 84%, according to the paper. Users requesting Claude Opus may instead receive responses from cheaper models such as Sonnet, Haiku, or even domestic Chinese alternatives like Qwen, with the output fraudulently relabeled.
The proxy operators also collect every prompt and response that passes through their servers. For coding agents, that means complete reasoning chains, repository context, and human-verified outputs, with several Chinese developers telling Qian that the access markup is essentially customer acquisition, and that harvesting those logs is the actual business. Datasets of Claude Opus 4.6 reasoning outputs with no clear provenance already circulate on HuggingFace.
Stay On the Cutting Edge: Get the Tom's Hardware Newsletter Get Tom's Hardware's best news and in-depth reviews, straight to your inbox. Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors
Proxy-harvested reasoning data is incredibly valuable for distillation because reasoning outputs can be systematically captured and used to train competing models. Proxy servers offer the same pipeline at lower effort, because paying customers generate the training data voluntarily.
... continue reading