Gray-Market AI Proxies ("Poison Claude")
- What Poison Claude actually is — and why the discount is real, not a bait-and-switch
- The one-line environment-variable change that turns Claude Code into a data-leak pipe
- How to detect a teammate (or your own past self) already routing prompts through one
- The signals that separate a legitimate AI gateway from a gray-market reseller
- Why 'we don't put secrets in prompts' is not a defense here
On August 4, 2026, Okta Threat Intelligence published Free tokens for sale: How fake signups drive AI fraud, documenting a live service called Poison Claude that was reselling access to Anthropic's Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6 through underground forums — at 5–15% of the official per-token price, payable in cryptocurrency. An exposed /api/status endpoint showed 881 users, 872 active as of July 3, 2026.
The interesting part is not the fraud. It's the design: Poison Claude gives you a real Anthropic-compatible API key, and Claude Code works normally when you point at it. The prompts, tool calls, files, and outputs just take a detour through the operator's server on their way to Anthropic. The operator sees everything.
This page is the companion to Vetting Agent Skills and Reviewing Third-Party Code for a different supply-chain vector: not the code you install, but the endpoint you talk to.
Where the discount comes from
Poison Claude isn't stealing API keys — that's the easy story to tell and it's wrong. It's arbitraging cloud provider new-account credits at scale. Okta's write-up documents the mechanism:
- New AWS accounts get ~US$100 in credits usable on Bedrock (which brokers Claude). The operator creates a pool of throwaway AWS accounts using synthetic identities.
- Signups came from proxy/VPN networks in Lebanon, Indonesia, and Thailand, using disposable-email domains like
dakaka.org,emailinbo.live,ratixq.com. - Prompts from paying customers get load-balanced across the pool of trial accounts. Each customer request is a real Bedrock call funded by AWS's free credits — until AWS catches on and revokes.
- The operator pockets the spread. 5–15% of list price is comfortable margin because most of the input side is subsidized.
A parallel service, Ecomagent (ecomagent.in, ~1,000 users), used the same pattern for Opus 4.8, Opus 4.6, Sonnet 4.6, and GPT Codex 5.5 — with indicators of Google Vertex AI in the mix.
The takeaway: the discount is technically real. Nobody is scamming you on the money. The scam is the second-order effect.
The proxy-visibility problem is not a bug
When your client is pointed at https://poison-claude.bitsender.top (Cloudflare-fronted; the API path was on api.claudeopus.shop, Hostinger Mumbai), your request has to be readable by that server so it can be forwarded to Anthropic. TLS terminates at the proxy, not at Anthropic. This isn't a flaw in Poison Claude — it's the definition of a gateway proxy:
"When services are configured as a gateway proxy, the service provider has full visibility into prompts, as those prompts must be forwarded to a model." — Okta Threat Intelligence, August 2026
So the operator sees, in cleartext:
| Class of data | Why it ends up in the request | Impact if logged |
|---|---|---|
| System prompts | Your CLAUDE.md, org playbooks, internal jargon | Reveals your architecture, prompt-engineering IP, employee names |
| File contents | Code the agent reads, docs you pass in, screenshots | Full source-code exfiltration, one PR at a time |
| Tool arguments | DB queries, cURL commands, filenames, paths | Internal URLs, table names, cloud-resource IDs |
| Long-term memory | Everything you asked Claude to "remember" | Persistent leak — years of context in one dump |
| Model outputs | Whatever Claude writes back | Your generated code, decisions, drafts |
"We don't put secrets in prompts" is not a defense. The interesting data isn't API keys — it's the code, decisions, and internal context that flow through an agent's day.
The one-line pivot: ANTHROPIC_BASE_URL
Claude Code (and the underlying Anthropic SDK) is designed to be gateway-friendly on purpose — legitimate use cases like corporate observability layers, regional bridges, or LiteLLM/Portkey/OpenRouter routing all depend on it. The knobs:
export ANTHROPIC_BASE_URL="https://gateway.example/anthropic"
export ANTHROPIC_AUTH_TOKEN="sk-…"
Once set, every request the CLI makes — the main conversation, sub-agents, background compaction, tool calls — goes to that base URL. A single .envrc, a ~/.zshrc line, or a shell profile a "helpful" tutorial talked someone into pasting is enough. It is read at process start and never re-checked, so nothing prompts you to reconsider mid-session. See Claude Code environment variables for the full list.
The equivalent variables exist for other clients (OpenAI-shaped SDKs read OPENAI_BASE_URL; Google clients read region overrides). The vector is generic.
Grep for stealth base-URL overrides — run once per machine
# what environment variables are actively pointing your AI clients elsewhere? env | grep -Ei 'ANTHROPIC_|OPENAI_|GOOGLE_|GEMINI_|BASE_URL|_ENDPOINT|AUTH_TOKEN' # where are they SET? — check the usual suspects grep -RIn --color \ -e 'ANTHROPIC_BASE_URL' -e 'ANTHROPIC_AUTH_TOKEN' \ -e 'OPENAI_BASE_URL' -e 'OPENAI_BASE_API' \ ~/.zshrc ~/.bashrc ~/.profile ~/.zshenv ~/.envrc \ ~/.config/fish/config.fish ~/.config/claude 2>/dev/null # any project-level overrides? find ~ -name '.envrc' -o -name '.env' -o -name '.env.local' 2>/dev/null \ | xargs grep -l 'BASE_URL\|AUTH_TOKEN' 2>/dev/null
The IOCs to check (Aug 2026)
If you're doing an audit, these are the concrete indicators Okta published. Do not visit them.
- poison-claude.bitsender.top (Cloudflare-fronted; Cloudflare later placed a phishing warning); api.claudeopus.shop (Hostinger Mumbai; Cloudflare declined action on this API subdomain). Related service: ecomagent.in.
- grep for those hostnames — and for the strings 'claudeopus', 'poison-claude', 'bitsender', 'ecomagent' — in ~/.zsh_history, ~/.bash_history, .env* files, and any CI environment secrets. Also check ~/.config/claude/settings.json.
- In firewall / EDR logs, look for HTTPS to domains that resolve into small hosters (Hostinger, Contabo, dedicated-server providers) *and* accept Anthropic Messages API traffic. Traffic to api.anthropic.com should be direct; traffic to unfamiliar hosts on /v1/messages is the tell.
- Signups from Lebanon/Indonesia/Thailand VPN nodes, disposable-email domains (dakaka.org, emailinbo.live, ratixq.com), and mass account creation with the same billing card fingerprint are Okta's core signals. If you run an AI product with trial credits, you are the upstream target.
Legitimate gateway vs gray-market reseller
Corporate AI gateways exist for good reasons — observability, DLP, cost control, cross-provider routing. Confusing the two is what makes gray-market services viable in the first place. Signals that separate them:
| Signal | Legitimate gateway (LiteLLM, Portkey, OpenRouter, corporate) | Gray-market reseller |
|---|---|---|
| Price | ≥ upstream list, often + margin | 5–15% of list — nothing legal makes prompts 10× cheaper |
| Company | Legal entity, published address, funding, LinkedIn team | Anonymous, crypto-only, Telegram/forum-only support |
| Payment | Card / invoice / SSO-billed | Monero, USDT, crypto exclusively |
| T&Cs | Named DPA, data-processing addendum, region controls | No DPA, no retention policy, no incident-response commitment |
| Distribution | Docs on the vendor's site, npm/pip packages, PRs to Claude Code | Underground forums, invite-only channels, mirrored install scripts |
| Domain age & posture | Multi-year, HSTS, matching WHOIS, MX records | New TLD (.shop, .top, dynamic-DNS suffix), CDN mask over lookalike name |
If the reason to switch is "it's suspiciously cheap," you have your answer. Every prompt an operator can decrypt has monetization paths beyond the tokens — corpora for cheap-model fine-tuning being one of them.
What to do this week
- Explicit allow: api.anthropic.com, plus any gateway you procured (LiteLLM instance, corporate proxy, Bedrock endpoint under your account). Everything else is denied. Put it in your Claude Code / Cursor / Codex team docs where a new hire will actually see it.
- The grep above, run via MDM or a one-liner in a team channel. Anything pointing outside your allow-list is a rotate-and-remove event.
- On managed endpoints, at the firewall, or via EDR. You want a durable record of which host each agent process talked to. Cheap now, priceless if you ever need to prove nothing left the boundary.
- Treat every prompt from that period as disclosed. Rotate anything the agent could have read that was long-lived (deploy tokens, DB creds, SSH keys pulled from the repo). Wipe agent memory files that were written during that window.
- The people using these aren't malicious — they hit a rate limit at 2am or wanted to try Opus without a budget. Give them a legitimate path (a shared org key, a budget bump, a self-serve gateway) or they'll find the shady one again.
Ask your agent to diff its own effective config against your allow-list
Read all of the following and tell me if any AI client on this machine is pointed at a base URL, endpoint, or auth token that is NOT one of: - https://api.anthropic.com - <PASTE YOUR CORPORATE GATEWAY URL(S) HERE> Sources to check: 1. `env | grep -Ei 'ANTHROPIC|OPENAI|GEMINI|BASE_URL|AUTH_TOKEN'` 2. ~/.zshrc, ~/.bashrc, ~/.profile, ~/.zshenv, ~/.envrc 3. ~/.config/claude/settings.json and any project .claude/settings.json 4. .env, .env.local, .envrc in any repo under ~/code (or your work dir) 5. Shell history: grep 'BASE_URL\|claudeopus\|bitsender\|poison' ~/.*history For each finding: full path, exact line, and whether the target host is in the allow-list. Do NOT contact any of the URLs. Report only.
Gut-check
Check yourself
0/4Related
- Vetting Agent Skills You Install — supply-chain problem for the code you install
- Reviewing Third-Party Code — the general "it can execute" checklist
- What Your Agent Uploads — what's actually in a prompt when it leaves your machine
- Securing MCP Servers — trust boundary for tools, mirrors the endpoint problem
- AI Gateways: LiteLLM, OpenRouter, Portkey — legitimate uses of the same routing mechanism
- Claude Code Settings — the environment variables that control where Claude talks
Sources & further reading
- Okta Threat Intelligence — Free tokens for sale: How fake signups drive AI fraud (Jeremy Kirk & Mathew Woodyard, Aug 4, 2026) — primary source with IOCs, user counts, and fraud methodology
- The Hacker News — Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt (Aug 2026)
- Cyberpress — Poison Claude Abuses Fake Accounts and Free Credits to Sell Discounted AI Access Tokens
- GBHackers — Hackers Abuse Cloud Startup Credits to Resell Claude and Gemini AI Access
- Anthropic — Claude Code settings reference — official docs on
ANTHROPIC_BASE_URLand related environment variables - AWS — Free tier & new-account credits for Amazon Bedrock — the subsidy being arbitraged