Fast Facts
- Cybercriminals are selling illegal access to AI models like Anthropic’s via underground forums, using compromised accounts and exploitative payment methods to bypass licensing and cost restrictions.
- Services like Poison Claude and Ecomagent.in proxy AI model prompts, risking data leakage, privacy breaches, and potential misuse by malicious actors.
- Emerging AI-related threats include abuse of free trials for synthetic identity creation and extensive bot activity leveraging AI agents and residential proxies, complicating detection and mitigation efforts.
The Threat, Attack Techniques, and Targets
Cybercriminals are now offering illegal access to artificial intelligence (AI) models through underground services like Poison Claude. This service advertises access to Anthropic’s large language models (LLMs) such as Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6. The service uses fake accounts that take advantage of free bonus credits, like the $100 AWS bonus, to reduce costs. Customers pay in cryptocurrencies and receive an API key that connects their environment to Poison Claude’s API.
The process involves sending prompts through Poison Claude’s system to Anthropic’s models. The responses are then returned to the customers. The service claims to keep costs low by routing requests through a pool of accounts. Additionally, security researchers found a configuration error that exposed user data but has been fixed. The main domain hosting Poison Claude is concealed behind Cloudflare’s CDN, which helps hide its true IP address. Despite a warning from Cloudflare, the API domain is still active and protected with bot defense services.
Another similar service in the gray market is Ecomagent.in. It offers access to models like Opus 4.8, Opus 4.6, Sonnet 4.6, and OpenAI’s GPT Codex 5.5. These services attract users mainly because of lower costs, restrictions, or privacy. However, they also pose significant risks, including the potential for service providers to monitor prompts or refuse access after gaining user trust.
Impact, Security Implications, and Remediation Guidance
The availability of these illegal AI access services presents several risks. Users may unknowingly give their prompts to malicious actors, risking privacy breaches or data leaks. Service providers may cut off access to fraudulent accounts, which can leave users unable to access their tools. Additionally, users might receive less capable AI models than advertised, impacting their work or research.
The fact that these services operate by proxy means that the providers can see all prompts sent to the AI models. This raises serious privacy concerns, as sensitive data could be leaked or sold without users’ knowledge. The exposure of the Poison Claude API also highlights risks of data breaches.
To address these issues, organizations should avoid using unofficial or illegal AI services. They must consider the security and privacy risks involved. If there are concerns about unauthorized AI use, affected parties should seek remediation guidance from the relevant vendor or authority. This will ensure they receive appropriate support and protection against potential threats or data leaks.
Expand Your Tech Knowledge
Explore the future of technology with our detailed insights on Artificial Intelligence.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
