Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt
Summary: Okta researchers found more than half-a-dozen advertisements for illegal access to AI models on underground cybercrime forums and messaging platforms, including Poison Claude, which claims to resell Anthropic models such as Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6 at 5-15% of the official per-token price by pooling accounts that carry free bonus credits like the US$100 AWS Bedrock credit. A configuration error exposed Poison Claude's status endpoint, which returned 881 total users and 872 active users before the exposure was fixed, and a similar gray-market service, Ecomagent.in, is estimated to have nearly 970 users.
What you should know: Because Poison Claude routes every request through its own gateway proxy, its operator has full visibility into customer prompts and could leak or sell them - and with 872 active users on one such service, prompts that developers believe are private are passing through a third party.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026