Poison Claude Sells Discounted AI Access, Giving Its Operator Visibility Into Prompts
Summary
Okta researchers say Poison Claude sells discounted access to Anthropic models through proxy accounts, giving the service operator visibility into prompts. They also reported an exposed status endpoint, later fixed, and abuse of AI free trials for bot activity.
Key points
- Poison Claude claims to provide discounted Anthropic model access by routing customer requests through accounts using AWS Bedrock bonus credits.
- Customers receive an API key and configure development tools to send prompts through Poison Claude before they reach Anthropic.
- Okta researchers said the proxy setup gives the service provider visibility into prompts, creating privacy and data-leak risks.
- A configuration error exposed Poison Claude's api[.]claudeopus[.]shop/api/status endpoint, which showed 881 total and 872 active users; the exposure was fixed.
- Researchers said the Poison Claude site, poison-claude[.]bitsender[.]top, received a Cloudflare phishing warning after disclosure.
- Another service, Ecomagent.in, is estimated to have nearly 970 users and advertises access to Anthropic and OpenAI models.
- The article also describes attackers abusing AI free trials and residential proxies for bot activity and synthetic identity creation.
Article Details
- Event Type
- Underground services offering discounted or fraudulent access to AI models through proxy APIs
- Impact
- Poison Claude claims to route customer prompts to Anthropic models through accounts using AWS Bedrock bonus credits, and the service operator can see prompts forwarded through its gateway. An exposed status endpoint reportedly revealed 881 total users and 872 active users; the exposure was fixed. These services also pose risks of data exposure, model substitution, and loss of access if fraudulent accounts are shut down. Okta researchers also report that bad actors abuse AI-service free trials and disposable domains for synthetic identity creation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | api[.]claudeopus[.]shop | Poison Claude API domain used to route customer requests; the article says the service's exposed status endpoint was fixed. |
| DOMAIN | dakaka[.]org | Identified as a disposable domain used by bad actors abusing AI-service free trials for synthetic identity creation. |
| DOMAIN | emailinbo[.]live | Identified as a disposable domain used by bad actors abusing AI-service free trials for synthetic identity creation. |
| DOMAIN | poison-claude[.]bitsender[.]top | Main domain for Poison Claude, a service claiming to provide discounted access to Anthropic models through accounts using bonus credits. |
| DOMAIN | ratixq[.]com | Identified as a disposable domain used by bad actors abusing AI-service free trials for synthetic identity creation. |
People
Vendors
Amazon Web ServicesThe service exploits bonus credits from AWS Bedrock accounts.AnthropicResearchers found multiple underground services selling illegal access to AI models, including Poison Claude, which routes requests to Anthropic LLMs through discounted or fraudulent accounts.Cloudflare#PoisonClaudeDeepSeek#PoisonClaudeMiniMax#PoisonClaudeMoonshot AIEarlier this year, Anthropic accused three Chinese firms, DeepSeek, Moonshot AI, and MiniMax, of orchestrating “industrial-scale campaigns” to illegally extract Claude’s capabilities to improve their own models.OpenAI#PoisonClaude
Products
Amazon BedrockThe service exploits bonus credits from AWS Bedrock accounts.Claude Codeand instructed to set certain environment variables to ensure that their development environment (i.e, Claude Code) uses the Poison Claude API instead of Anthropic’s.Claude Sonnet 4.6One such service, Poison Claude, claims to offer access to Anthropic’s large language models (LLMs), including Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6.GPT Codex 5.5and claims to offer discounted access to Anthropic’s Opus 4.8, Opus 4.6, Sonnet 4.6 and OpenAI’s GPT Codex 5.5 via a custom API endpoint.Opus 4.6One such service, Poison Claude, claims to offer access to Anthropic’s large language models (LLMs), including Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6.Opus 4.7One such service, Poison Claude, claims to offer access to Anthropic’s large language models (LLMs), including Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6.Opus 4.8One such service, Poison Claude, claims to offer access to Anthropic’s large language models (LLMs), including Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6.