Stolen AI credentials feed growing LLM proxy economy

Malicious actors are using proxy servers, or transfer stations, to conceal the origin of traffic directed toward frontier AI models. These services provide cover for activities such as model distillation attacks and potential abuse of stolen AI subscription credentials. Security research identified over 80,000 such proxies running open-source relay platforms like Claude Relay Service (CRS) and sub2api. These transfer services authenticate customers but connect to upstream AI services using stolen API keys or consumer subscriptions obtained through malicious activities.
The investigation linked clusters of activity through these proxies to IP addresses in China and Hong Kong, with many transfer gateways hosted on US VPS services, suggesting an intent to obscure geographic location for potential model distillation attacks. Further analysis revealed that the traffic pattern indicated upload-heavy communication toward Western providers like Anthropic, OpenAI, and Google, which could equate to billions of input tokens if text-based context was involved in distillation attempts.
The findings highlight that stolen credentials, including session tokens and API keys from various AI services (Anthropic, Gemini, OpenAI, Groq, etc.), are being harvested through methods like information stealers and phishing campaigns. This activity supports industrial-scale model distillation and token-jacking schemes, leading to significant potential financial losses for victims.

* Over 80,000 proxy servers have been observed cloaking traffic to frontier models.
* Malicious actors employ proxy servers, known as transfer stations, to hide traffic origins.
* These services provide cover for model distillation attacks and abuse of stolen AI subscription credentials.
* Researchers initially identified 10,867 servers running Claude Relay Service (CRS) and sub2api; the total estimate is over 80,000 proxies.
* Transfer stations authenticate customers with their own accounts but connect to upstream AI services using pools of API keys or subscriptions obtained through malicious activities.
* Activity was linked to IP addresses in China and Hong Kong.
* Some transfer gateways are hosted on VPS services in the US.
* Distillation attacks have been reported against frontier models.
* Stolen credentials, including Anthropic session tokens and API keys for Gemini, OpenAI, Groq, and others, were found in infostealer data dumps.
* A threat actor was observed validating credentials from hosts and uploading working keys to an AI API-reselling gateway.
* Traffic analysis showed seventeen relays proxying traffic to Anthropic's API, involving 81GB upload for approximately 1.4GB reception.

The narrative reveals a structural vulnerability where the trust assumption—that an account making a request belongs to the consumer—is intentionally broken by an entire ecosystem of transfer services. This infrastructure moves beyond simple credential theft into operationalizing large-scale, automated attacks against proprietary models. The presence of specialized relay packages with commercial sponsors suggests this is not merely opportunistic exploitation but a semi-organized mechanism for exploiting access layered on top of existing compromises.
The convergence of geographically diverse infrastructure (China/Hong Kong source IPs funneling through US VPS relays) and the explicit mention of industrial-scale distillation aligns disparate threat vectors—credential theft, supply-chain attacks, and infrastructure abuse—into a single, coherent objective focused on model extraction. This suggests that the exploitation chain is designed not just to steal tokens but to create an environment where high-volume data exfiltration (like in the 16B–23B token estimate) becomes systematically masked as legitimate traffic flow across international boundaries.
The response highlighted by experts focuses heavily on application-layer defense, shifting the burden from perimeter security to behavioral telemetry and output controls. The pattern suggests that simply locking down access points is insufficient when the underlying mechanism permits legitimate-looking operations to serve illicit goals. The implication is that cognitive sovereignty requires defending the operational context—the session and behavior—of AI access, rather than just the endpoints themselves.
Bridge Questions: If authorization layers are fundamentally compromised through shared relay systems, what resilience measures exist that operate independently of provider policy enforcement? How can organizations effectively monitor and counter behavioral telemetry when attack surface is deliberately obscured by cross-jurisdictional infrastructure? What systemic shifts are required to make ephemeral session control a more robust security boundary than static credentials?