China's proxy network sells Claude AI tokens cheap

Anthropic has built one of the toughest access regimes for its Claude models, blocking Chinese IPs, demanding foreign credit cards, and even requiring live‑selfie verification for some accounts. Despite these barriers, a thriving underground market has emerged that lets Chinese developers obtain Claude tokens for about ten percent of the advertised price. The phenomenon was detailed in a recent analysis by Zilan Qian of the Oxford China Policy Lab, which traced the flow of tokens from overseas proxy operators to end users inside China.

The core of the operation consists of "transfer stations" – servers located outside China that act as middlemen for API calls. A user in China sends a request to the proxy, which forwards it to Anthropic as if it originated from an approved location, then returns the response. Payments are made in yuan via popular platforms such as WeChat and Alipay, eliminating the need for VPNs or foreign credit cards. Catalogues of these stations are shared in community directories, where they are ranked by price and reliability, and the cheapest offerings can be as low as one‑tenth of the standard rate.

Anthropic’s defensive measures include phone‑number verification, foreign billing address checks, and bans on entities with more than half ownership from restricted regions. For a subset of users, the company also enforces KYC procedures that require a government ID and a live selfie. The analysis notes that even these biometric checks are being sidestepped: synthetic IDs, deep‑fake videos, and recruited individuals in low‑income countries are used to satisfy the requirements, echoing earlier black‑market activity around Worldcoin’s iris‑scan system.

The Chinese circumvention infrastructure mirrors earlier illicit supply chains that have surrounded other AI services. Account brokers mass‑register Anthropic accounts, SMS verification services supply foreign numbers, and reverse‑engineering groups study detection methods. Downstream, the tokens are marketed on Chinese e‑commerce sites like Taobao. Researchers at Germany’s CISPA Helmholtz Center observed that many proxies also perform "model swapping," redirecting requests intended for the high‑end Opus 4.7 model to cheaper alternatives such as Sonnet or even domestic models like Qwen, a practice the community calls "diluting."

These workarounds create several risks. Every request that passes through a proxy can be logged, exposing prompts, responses, tool calls, and code snippets to the operator. Such data could be harvested for training or model‑distillation purposes, a concern highlighted by the presence of Claude‑generated datasets on HuggingFace with unclear provenance. The analysis also flags the potential for biometric data collected during KYC workarounds to be sold for fraud or deep‑fake creation, and notes that stolen or fraudulently used credit cards may fund some of the token pools, though the exact scale is unknown.

Anthropic has already reported large‑scale distillation attacks by Chinese firms such as Deepseek, Moonshot, and MiniMax, which generated millions of requests through fake accounts. The company responded by cutting off services to entities under Chinese control and shutting a subsidiary loophole. However, the gray‑market channels described by Qian undermine these safeguards, allowing continued access and data extraction. Industry voices are divided on whether distillation is a legitimate research practice or a security threat; recent statements from major AI players argue against premature restrictions, suggesting that regulation may focus more on cybersecurity than on model copying.

Looking ahead, the persistence of transfer stations suggests that any future policy or technical countermeasure must address the modular nature of the supply chain. Because each participant typically runs only one or two links, the network can reconfigure within hours when a node is blocked. Observers will be watching for tighter enforcement from Anthropic, possible collaboration with other AI firms, and any governmental actions aimed at curbing the flow of AI capabilities across borders. The situation underscores how geoblocking, even when combined with biometric KYC, can be circumvented at scale, raising broader questions about the effectiveness of current AI export‑control strategies.