Team Cymru Finds LLM Relay Gateways Linked to Regional-Access Abuse and Possible Model Distillation
Summary
Team Cymru found more than 10,000 LLM relay gateways, later reporting over 80,000, that can mask users and bypass providers’ regional controls. Telemetry showed heavy uploads to Anthropic, though researchers could not confirm the prompts or prove model distillation.
Key points
- Team Cymru initially identified 10,867 confirmed Claude Relay Service and sub2api gateways; it later reported discovering more than 80,000 relays.
- The gateways pool provider credentials or subscription sessions and re-expose access through their own keys, obscuring users’ IP addresses from model providers.
- Over eight days, more than 4,000 China- and Hong Kong-based IP addresses connected to 304 U.S.-hosted transfer stations, transferring about 14 TB to the stations and receiving over 7 TB.
- In one cluster, 17 stations reached Anthropic’s API; traffic included about 81 GB uploaded and 1.4 GB downloaded, but researchers could not inspect prompts or determine whether the activity involved distillation.
- Researchers say the observed routing can bypass regional restrictions and shared-account controls; model distillation is a possible use, not a confirmed finding.
- The report also describes a Beijing host transferring more than 19 GB to a sub2api node and separately accessing a U.S. medical-imaging repository; that investigation is ongoing.
- Team Cymru shared discovered IPs with relevant AI vendors and published service-identification banner patterns for CRS and sub2api gateways.
Article Details
- Attack Vectors
- Claude Relay Service and sub2api turn pooled AI subscriptions or API credentials into shared gateways. Users authenticate to a transfer station, which authenticates to the model provider and masks the users' source IP addresses.
- In a cluster analyzed by Team Cymru, clients in China and Hong Kong connected through transfer stations to Western AI providers, bypassing provider regional-access restrictions.
- Team Cymru observed upload-heavy traffic from 17 transfer stations to Anthropic. It could not inspect the prompts or determine whether the activity was model distillation.
- The article describes possible abuse of AI accounts through promotional-offer exploitation or credential and token theft, but does not establish how the credentials in the analyzed cluster were obtained.
- Defensive Notes
- Team Cymru reports sharing discovered transfer-station IP addresses with relevant AI vendors and continuing to hunt for new nodes.
- The article provides banner-search patterns for identifying Claude Relay Service and sub2api gateways, but does not publish the discovered relay IP addresses.
- A later disclaimer says Team Cymru had discovered more than 80,000 relays, compared with the approximately 10,000 in its initial analysis.
MITRE ATT&CK
Vendors
Alibaba Groupof the two, is comprised of domestic Chinese AI providers: ByteDance Doubao/Volcano Engine, DeepSeek, Alibaba Qwen (DashScope), Zhipu and MiniMax. One possibility is that the routing of Chinese client traffic toAnthropicEndpoint Cluster 2 is significantly larger and comprises multiple U.S.-based frontier models (OpenAI, Anthropic, xAI, and Google endpoints). Traffic to this cluster was very upload-heavy, with a large amount of trafficByteDanceEndpoint Cluster 1, the smaller of the two, is comprised of domestic Chinese AI providers: ByteDance Doubao/Volcano Engine, DeepSeek, Alibaba Qwen (DashScope), Zhipu and MiniMax. One possibility is that the routing ofDeepSeekthe smaller of the two, is comprised of domestic Chinese AI providers: ByteDance Doubao/Volcano Engine, DeepSeek, Alibaba Qwen (DashScope), Zhipu and MiniMax. One possibility is that the routing of Chinese clientGoogle2 is significantly larger and comprises multiple U.S.-based frontier models (OpenAI, Anthropic, xAI, and Google endpoints). Traffic to this cluster was very upload-heavy, with a large amount of traffic directed toMiniMaxChinese AI providers: ByteDance Doubao/Volcano Engine, DeepSeek, Alibaba Qwen (DashScope), Zhipu and MiniMax. One possibility is that the routing of Chinese client traffic to these Chinese AI providers through aOpenAIAPI relay resellers (fifteen sponsors). Gateways selling access to Claude, OpenAI/Codex and Gemini; several marketed to so-called "heavy AI developers." It is likely that these sponsoring organizations require sub2apixAICluster 2 is significantly larger and comprises multiple U.S.-based frontier models (OpenAI, Anthropic, xAI, and Google endpoints). Traffic to this cluster was very upload-heavy, with a large amount of trafficZhipuof domestic Chinese AI providers: ByteDance Doubao/Volcano Engine, DeepSeek, Alibaba Qwen (DashScope), Zhipu and MiniMax. One possibility is that the routing of Chinese client traffic to these Chinese AI providers
Products
ClaudeClaude Relay Service (CRS 1.x) and its successor sub2api (CRS v2.0), are published on GitHub by author Wei-Shaw in Simplified Mandarin and are toolkits that have been widely adopted as proxies to access the frontierDoubaoEndpoint Cluster 1, the smaller of the two, is comprised of domestic Chinese AI providers: ByteDance Doubao/Volcano Engine, DeepSeek, Alibaba Qwen (DashScope), Zhipu and MiniMax. One possibility is that the routing ofGeminiAPI relay resellers (fifteen sponsors). Gateways selling access to Claude, OpenAI/Codex and Gemini; several marketed to so-called "heavy AI developers." It is likely that these sponsoring organizations require sub2apiQwenthe two, is comprised of domestic Chinese AI providers: ByteDance Doubao/Volcano Engine, DeepSeek, Alibaba Qwen (DashScope), Zhipu and MiniMax. One possibility is that the routing of Chinese client traffic to these
Tools
Claude Relay ServiceClaude Relay Service (CRS 1.x) and its successor sub2api (CRS v2.0), are published on GitHub by author Wei-Shaw in Simplified Mandarin and are toolkits that have been widely adopted as proxies to access the frontiersub2apiClaude Relay Service (CRS 1.x) and its successor sub2api (CRS v2.0), are published on GitHub by author Wei-Shaw in Simplified Mandarin and are toolkits that have been widely adopted as proxies to access the frontier
Countries
ChinaTeam Cymru has uncovered 10,000+ hidden gateway servers masking malicious activity originating in China that bypassed AI providers' region bans and potentially siphoned proprietary model outputs. This discovery nowUnited StatesWhen we analyzed telemetry collected from a transfer station cluster hosted on a few VPS providers in the U.S., we clearly identified Chinese IP addresses initiating connections to the transfer station cluster en masse,