Detailed Analysis
A scheme dubbed "Poison Claude" has surfaced in which threat actors advertise discounted access to Anthropic's Claude AI models through unofficial reseller channels, while covertly routing every customer prompt through infrastructure the operator controls. Rather than reselling legitimate API credentials or subscriptions, the scheme appears to function as a man-in-the-middle operation: users believe they are interacting directly with Claude at a reduced price, but their queries, inputs, and any sensitive data embedded in those prompts pass through an intermediary that can log, inspect, and potentially exploit that traffic. This pattern mirrors a broader category of abuse Anthropic and other AI vendors have grappled with, in which stolen or reverse-engineered API keys are laundered into cut-rate access sold on gray-market forums.
The mechanics of the scheme underscore a growing risk vector unique to the generative AI economy: prompt-level surveillance. Unlike traditional credential theft, where the damage is largely confined to account takeover or resource abuse, a poisoned proxy sitting between the user and the AI model has visibility into the actual content of every conversation. For enterprise users, this could mean exposure of proprietary code, internal business strategy, customer data, or confidential documents pasted into a chat window for summarization or analysis. Because these discounted access schemes are typically marketed to price-sensitive users or through channels that bypass official verification, victims often have no indication that a third party is silently harvesting their inputs until the data is misused or the operation is exposed.
This incident fits into a larger trend of "LLMjacking," where attackers steal or abuse API credentials for large language models to resell computing access, evade usage costs, or launder illicit token consumption through legitimate providers' infrastructure. Security researchers have documented similar schemes targeting AWS Bedrock, Google's Gemini, and OpenAI's API in the past two years, with stolen keys traded on dark web marketplaces and Telegram channels. What distinguishes "Poison Claude" is the added dimension of data interception — turning what looks like a simple cost-arbitrage scam into a potential espionage or data-harvesting tool, since the operator gains a persistent vantage point over every prompt submitted through the service.
The broader implication for the AI industry is that the trust boundary between users and model providers is increasingly being tested by unauthorized intermediaries capitalizing on the popularity and cost of frontier models like Claude, GPT-4, and Gemini. As enterprises and individual users seek cheaper ways to access powerful AI capabilities, the incentive for scammers to build convincing but malicious front-ends grows correspondingly. This raises the stakes for identity and access management practices around AI APIs, reinforces the importance of using only officially sanctioned access points and reseller partnerships, and signals that Anthropic and its peers will likely need to invest further in detecting anomalous usage patterns tied to stolen or misused credentials — both to protect their own infrastructure and to shield end users from having their most sensitive prompts silently exfiltrated by opportunistic middlemen.
Read original article →