What is the gray market AI access scheme called Poison Claude, how does it exploit stolen promotional cloud credits from AWS to sell discounted Anthropic model access via a proxy gateway, what privacy and security risks does it pose by exposing all customer prompts to the operato

Poison Claude is a gray-market API proxy service that resells access to Anthropic's Claude models at 5–15% of the official price by routing customer requests through fraudulently created cloud accounts funded with stolen AWS promotional credits. It was publicly documented by Okta Threat Intelligence in August 2026, which found more than half a dozen similar underground AI-access ads .

How Poison Claude works

The service operates at poison-claude[.]bitsender[.]top and offers Claude models including Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6 . Its business model has three layers:

• Credit harvesting. The operator creates or buys bulk fake accounts at cloud providers (AWS, Google Cloud, Anthropic) to collect free sign-up bonuses — for example, the $100 AWS Bedrock startup credit — and pools those accounts .
• Proxy gateway. Customer API requests are routed through a shared proxy that forwards them to Anthropic's real backend via one of the fraudulently funded accounts, then returns the response. To the customer it looks like an Anthropic endpoint, but it is a "black-box" relay .
• Pricing. Poison Claude charges well below market — as low as 5–15% of official per-token rates — and offers both "unlimited" metered prompt plans and a la carte token packages .

Privacy and security risks

Every customer prompt passes through the operator's proxy in plaintext, giving the operator full visibility into all user inputs and model outputs . Specific risks include:

• Prompt surveillance. The operator can log, analyze, or sell every prompt sent through the service — potentially exposing trade secrets, proprietary code, personally identifiable information, or sensitive business data .
• Model substitution or tampering. Because the gateway is opaque, the operator could swap requested models for cheaper or inferior ones, inject malicious content into responses, or manipulate outputs without the customer knowing .
• No service guarantee. The pooled accounts can be suspended by Anthropic or AWS at any time, and the operator can disappear with customer payments. Okta researchers found 872 exposed active users tied to one instance .

Broader underground market and Ecomagent

Poison Claude is one of at least half a dozen similar services discovered by Okta . A parallel service called Ecomagent[.]in operates on the same model: it offers "unlimited tokens" for subscriptions below market price, also using pooled fraudulent accounts and a shared proxy gateway . The underground ecosystem includes:

• Fake account factories. Threat actors mass-register synthetic or stolen identities at AWS, Google Cloud, Anthropic, and OpenAI to harvest free trial credits .
• Proxy resellers ("transfer stations"). In Chinese developer communities, similar gray-market Claude proxy networks (known as "transfer stations") sell access at as low as 10% of official prices, often with open-source tools like one-api as the relay layer .
• Four-layer supply chain. The market relies on virtual credit card merchants, bulk account creators, proxy gateway operators, and end-user developers who buy the cheap tokens .

U.S. regulatory context

Parallel to this growing gray market, the U.S. government has been debating how to oversee frontier AI models:

• In May 2026, the Trump administration began considering government pre-release vetting of advanced AI models, a shift from its earlier laissez-faire stance .
• By July 2026, the U.S. was in advanced talks with AI companies to create voluntary model release standards, with tightened oversight of new model deployments .
• In August 2026, the White House finalized a voluntary AI model review framework, but decided not to release it publicly — it will only be shared with select participating companies .
• A March 2026 White House National Policy Framework on AI laid out broad legislative recommendations, but the policy approach has faced internal division and "whiplash" between interventionist and hands-off camps .

This rising regulatory attention has focused primarily on model safety and national security risks, not specifically on gray-market reselling — which remains a gap that Poison Claude and similar services exploit.