Chinese-language API proxy services advertise access to Anthropic’s Claude models for as little as 10% of official prices, Oxford China Policy Lab research associate Zilan Qian reports. Her investigation describes a market in which intermediary operators handle developers’ requests and return model responses.
Known as “transfer stations,” these services route requests through their own servers. That arrangement gives operators potential visibility into prompts, responses and metadata, including private code and repository context submitted through coding tools.
Qian describes a layered supply chain involving account suppliers, proxy operators and secondary resellers. Services are promoted through platforms including GitHub, Taobao and Telegram.
Questions over model identity
Qian reports that customers requesting premium Claude models may instead receive output from cheaper alternatives, with the responses relabeled. Her account describes possible substitutions involving Sonnet, Haiku and Chinese model families such as GLM and Qwen.
A separate paper by researchers at the CISPA Helmholtz Center for Information Security identified 17 services it called “shadow APIs” and conducted detailed testing of three representative services. The researchers reported behavioral inconsistencies and model-fingerprinting evidence consistent with deceptive model claims at some audited endpoints.
Qian cites a comparison from that paper in which proxy access advertised as “Gemini-2.5” scored 37.00% on a medical benchmark, compared with 83.82% for the official API. Those are reported research findings; performance differences alone do not identify the model generating a response.
The findings concern the endpoints tested and do not establish which model every service advertising Claude access uses.
Potential exposure of developer data
Operators handling requests and responses can potentially record their content. In coding workflows, those exchanges may include source code, repository structure, API contracts, internal error logs and proposed changes across multiple files.
Qian suggests that proxy logs may have become a commodity traded for purposes including model training. That remains a possibility described in her account, rather than independently established evidence of a particular service selling customer data.
An operator’s ability to observe traffic does not by itself establish that it retains, sells or uses the exchanges for training. Model substitution and data collection are also separate questions: uncertainty about the model handling a request does not demonstrate misuse of its contents.
Account sourcing and access restrictions
Public discussions cited by Qian describe several ways operators reduce access costs: bulk-registering accounts to obtain free API credits, reselling unused account quotas, using corporate or educational discounts, and sharing subscription access among multiple users.
Her account also describes accounts purchased using stolen or fraudulent credit cards as a possible source of supply, while noting that their share is difficult to verify. This allegation concerns payment methods; it does not establish that the accounts themselves were stolen.
Qian also describes verification workarounds involving the recruitment of real people to complete identity checks on behalf of account operators.
Anthropic says it does not offer commercial Claude access in China. On September 5, 2025, the company expanded its regional restrictions to cover entities more than 50% owned, directly or indirectly, by companies headquartered in unsupported regions, regardless of where those entities operate.
