How Poison Claude Works

Poison Claude (hosted at poison-claude.bitsender.top) offers "unlimited" token plans and a la carte packages for four Anthropic models: Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6 . The service operates as a proxy — customers point their Claude Code client or Anthropic-compatible API calls to Poison Claude's infrastructure rather than Anthropic's official endpoint .

The economics are straightforward: the operator creates large numbers of fraudulent or synthetic accounts on AWS and AI providers . Each new AWS account qualifies for promotional bonuses such as the $100 AWS Activate credit for startups . Poison Claude pools these credits across hundreds or thousands of accounts, routes customer requests through them, and charges customers 5–15% of the official per-token price — pocketing nearly pure profit .

As the service's own website states: "We add those accounts to our pool, your request is routed to a specific account under the hood (you don’t see this) and you get charged 5-15% of the official per-token price depending on the model" .

Privacy and Security Risks to Customers

The discount comes at a steep cost. Because Poison Claude sits between the customer and Anthropic's API, it has full visibility into every prompt and response. This creates multiple risks:

• Prompt interception and data theft: The operator can read, log, or leak every prompt and response sent through the service .
• Prompt injection or model swapping: The operator could silently replace Opus 4.8 with a weaker/cheaper model or inject malicious content into responses .
• No data protection guarantees: Unlike official Anthropic API access, there are no contractual data-handling commitments, no SOC 2 compliance, and no guarantees about prompt retention or deletion .
• Service can vanish: The entire operation depends on fraudulent accounts that cloud providers will eventually terminate. Customers risk losing access and any data stored with the service without warning .
• Already exposed users: Okta found 872 active Poison Claude users whose data was exposed through the service's insecure operations .

The Broader Underground Market

Poison Claude is not an isolated operation. Okta's investigation uncovered more than half a dozen services on underground forums and messaging platforms offering discounted or "unlimited" token access to frontier AI models .

This gray-market ecosystem includes:

• Chinese "transfer station" proxy networks that resell Claude access at up to 90% off using stolen credentials and fraudulent accounts. A 2026 report by Oxford China Policy Lab investigator Zilan Qian documented these services operating openly on GitHub, Taobao, and Telegram, collecting every prompt and response for resale as training data .
• LLMjacking — stolen AI compute repurposed not just for resale but as offensive infrastructure for autonomous cyberattacks, as documented by Sysdig's Threat Research Team .
• Industrial-scale distillation campaigns: Anthropic itself has identified campaigns by DeepSeek, Moonshot, and MiniMax that generated over 16 million exchanges through approximately 24,000 fraudulent accounts to illicitly extract Claude's capabilities . Anthropic noted these labs use "commercial proxy services which resell access to Claude and other frontier AI models" to circumvent restrictions .

Okta's findings show these operations share a common playbook: abuse free trial credits and startup programs, create synthetic identities at scale, and route API calls through shared proxy infrastructure . The cloud providers' customer-acquisition incentives — designed to attract legitimate startups — have become a multi-million-dollar fraud pipeline.

What This Means for Developers and Enterprises

For developers and enterprises tempted by heavily discounted API access, the message from security researchers is clear: there is no such thing as a free lunch in frontier AI access. Every prompt sent through a service like Poison Claude is a data liability — and the risks extend beyond individual privacy to potential corporate data leakage, intellectual property theft, and compliance violations.

The only way to ensure your prompts, your data, and your model outputs remain private is to use official, contractually governed API access from Anthropic directly.

How Poison Claude Works

Poison Claude (hosted at poison-claude.bitsender.top) offers "unlimited" token plans and a la carte packages for four Anthropic models: Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6 . The service operates as a proxy — customers point their Claude Code client or Anthropic-compatible API calls to Poison Claude's infrastructure rather than Anthropic's official endpoint .

The economics are straightforward: the operator creates large numbers of fraudulent or synthetic accounts on AWS and AI providers . Each new AWS account qualifies for promotional bonuses such as the $100 AWS Activate credit for startups . Poison Claude pools these credits across hundreds or thousands of accounts, routes customer requests through them, and charges customers 5–15% of the official per-token price — pocketing nearly pure profit .

As the service's own website states: "We add those accounts to our pool, your request is routed to a specific account under the hood (you don’t see this) and you get charged 5-15% of the official per-token price depending on the model" .

Privacy and Security Risks to Customers

The discount comes at a steep cost. Because Poison Claude sits between the customer and Anthropic's API, it has full visibility into every prompt and response. This creates multiple risks:

• Prompt interception and data theft: The operator can read, log, or leak every prompt and response sent through the service .
• Prompt injection or model swapping: The operator could silently replace Opus 4.8 with a weaker/cheaper model or inject malicious content into responses .
• No data protection guarantees: Unlike official Anthropic API access, there are no contractual data-handling commitments, no SOC 2 compliance, and no guarantees about prompt retention or deletion .
• Service can vanish: The entire operation depends on fraudulent accounts that cloud providers will eventually terminate. Customers risk losing access and any data stored with the service without warning .
• Already exposed users: Okta found 872 active Poison Claude users whose data was exposed through the service's insecure operations .

The Broader Underground Market

Poison Claude is not an isolated operation. Okta's investigation uncovered more than half a dozen services on underground forums and messaging platforms offering discounted or "unlimited" token access to frontier AI models .

This gray-market ecosystem includes:

• Chinese "transfer station" proxy networks that resell Claude access at up to 90% off using stolen credentials and fraudulent accounts. A 2026 report by Oxford China Policy Lab investigator Zilan Qian documented these services operating openly on GitHub, Taobao, and Telegram, collecting every prompt and response for resale as training data .
• LLMjacking — stolen AI compute repurposed not just for resale but as offensive infrastructure for autonomous cyberattacks, as documented by Sysdig's Threat Research Team .
• Industrial-scale distillation campaigns: Anthropic itself has identified campaigns by DeepSeek, Moonshot, and MiniMax that generated over 16 million exchanges through approximately 24,000 fraudulent accounts to illicitly extract Claude's capabilities . Anthropic noted these labs use "commercial proxy services which resell access to Claude and other frontier AI models" to circumvent restrictions .

Okta's findings show these operations share a common playbook: abuse free trial credits and startup programs, create synthetic identities at scale, and route API calls through shared proxy infrastructure . The cloud providers' customer-acquisition incentives — designed to attract legitimate startups — have become a multi-million-dollar fraud pipeline.

What This Means for Developers and Enterprises

For developers and enterprises tempted by heavily discounted API access, the message from security researchers is clear: there is no such thing as a free lunch in frontier AI access. Every prompt sent through a service like Poison Claude is a data liability — and the risks extend beyond individual privacy to potential corporate data leakage, intellectual property theft, and compliance violations.

The only way to ensure your prompts, your data, and your model outputs remain private is to use official, contractually governed API access from Anthropic directly.