Loading story…
Team Cymru identified an ecosystem of AI relay services that lets users in China access U.S. large-language-model providers despite regional restrictions. The researchers initially confirmed 10,867 relay servers and later estimated that the network exceeds 80,000 servers. The services pool accounts held with Western AI providers, distribute customer requests across models, and provide customers with their own API keys, obscuring the actual users’ identities and locations from the providers.
Most observed relays used the open-source Claude Relay Service or its successor, sub2api, published by a developer known as Wei-Shaw. Network traffic from a U.S.-hosted relay cluster showed substantial connections from China and Hong Kong and high outbound volumes to Anthropic’s API, potentially consistent with automated large-scale querying, though Team Cymru could not determine whether model distillation occurred. The routing infrastructure undermines attribution, metering, rate limits, abuse detection, geographic controls, and provider terms; Team Cymru has shared relay IP addresses with affected providers and plans to continue tracking the infrastructure.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
Team Cymru found that a Beijing CHINANET host, which sent more than 19 GB to a sub2api relay node, separately accessed a U.S.-hosted medical-imaging data repository that purportedly required authenticated access. The firm said the activity remained under analysis.
Team Cymru shared the IP addresses of identified relay infrastructure with affected AI-model providers and said it would continue searching for newly deployed relay servers. The organization assessed that the architecture hinders enforcement of regional restrictions, attribution, metering, rate limiting, and abuse detection.
Team Cymru published its “Relaying to the Frontier” report describing Chinese model routers, or transfer stations, that relay access to Western AI models and separate credential-owning accounts from the actual users. The organization initially confirmed 10,867 relays and later estimated that the ecosystem exceeded 80,000 servers; most identified relays used Claude Relay Service or sub2api.
Over an eight-day period in late August, Team Cymru observed more than 4,000 addresses in China and Hong Kong connecting to 304 relays in a U.S.-hosted VPS cluster. The users uploaded about 14 TB and downloaded more than 7 TB; 17 relays sent traffic directly to Anthropic's API, with traffic patterns potentially consistent with automated large-scale querying.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcenetaskari.substack.com
Open sourceteam-cymru.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA, the NSA, and the FBI allege that China-based AI companies—including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI—ran industrial-scale campaigns to extract capabilities from U.S. frontier models. The activity reportedly generated billions of tokens and millions of requests to Claude, GPT, Gemini, and Grok through coordinated API routing, cloud providers, aggregators, relays, proxy networks, and rotating vendor accounts. Anthropic said it identified seven campaigns targeting Claude since February 2026; the largest, allegedly linked to Alibaba, made more than 151 million requests between May and July. According to the agencies and Anthropic, operators used fraudulent accounts, stolen API keys, payment and quota optimization, automated failover, and—in some cases—covert forwarding of user prompts to sustain collection and train competing models from the outputs. The activity may have exposed user-provided source code, corporate documents, personal data, and credentials. Anthropic said it blocked implicated accounts and proxy infrastructure and reduced the reasoning detail exposed by its models, while U.S. agencies recommended cross-provider sharing of high-confidence behavioral and infrastructure indicators and covert response degradation for suspected distillation operations.
Sep 18, 2026
**Anthropic** reported detecting “industrial-scale” **distillation** activity targeting its *Claude* models and attributed it to three Chinese AI labs: **DeepSeek, Moonshot, and MiniMax**. Anthropic said the actors used **~24,000 fraudulent accounts** and generated **~16 million exchanges** with Claude, allegedly leveraging proxy/reseller access to evade controls and violate terms of service and regional restrictions. The company characterized the activity as deliberate capability extraction rather than normal customer usage, and paired the disclosure with renewed calls for stronger export controls. Anthropic warned that models produced via illicit distillation may lack safety guardrails and could be repurposed for **national security-relevant misuse**, including **offensive cyber operations**, surveillance, and disinformation. Reporting described tactics including coordinated fake-account networks (“hydra clusters”), proxy services, and prompt patterns aimed at extracting advanced reasoning and other capabilities at scale; one breakdown cited DeepSeek activity at **150,000+ exchanges** and Moonshot at **3.4M+ exchanges**, alongside prompt engineering intended to elicit step-by-step reasoning. Separate coverage on training-data memorization/copyright and a vendor blog on AI-driven crypto fraud discuss broader AI risk trends but do not address Anthropic’s specific distillation allegations.
Jul 16, 2026
The NSA, CISA, and FBI issued a joint advisory alleging that China-based AI companies have systematically extracted proprietary capabilities from U.S. frontier models since late 2024. The advisory named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, alleging campaigns targeting variants of Anthropic Claude, OpenAI ChatGPT, Google Gemini, and Grok. The agencies said the companies allegedly generated billions of tokens and millions of model interactions through unauthorized or obscured access, distributing requests across accounts, APIs, cloud providers, aggregators, proxies, and gray-market services to evade safeguards and attribution. They characterized the activity as part of China’s AI-development strategy and urged AI developers, government agencies, and allied partners to improve detection, adjust response measures, and share threat intelligence.
Sep 11, 2026