"We add those accounts to our pool, your request is routed to a specific account under the hood (you don't see this), and you get charged 5-15% of the official per-token price depending on the model."
Poison Claude's pitch: discounted access routed through pooled accounts
That sentence is printed on the Poison Claude website, according to an analysis by Okta researchers Jeremy Kirk and Mathew Woodyard published Tuesday. Poison Claude advertises access to Anthropic's large language models — naming Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6 — and promises cheaper token pricing by pooling accounts it says are funded in part by free bonus credits such as the US$100 AWS credit for Bedrock accounts.
Customers pay in cryptocurrency, receive an API key for an Anthropic-compatible endpoint, and are instructed to set environment variables so their development environment (specifically Claude Code) points at Poison Claude's API instead of Anthropic's. Prompts entered by customers are passed from Poison Claude's API to Anthropic and the answers are returned to the customer in the same chained fashion, Okta reports.
Okta's discovery: an exposed status endpoint and user counts
Okta found a configuration error exposing the API status endpoint — api.claudeopus[.]shop/api/status — which returned the number of total and active users as 881 and 872, respectively. That exposure has since been fixed, the researchers said. The disclosure was part of a broader look at more than half-a-dozen advertisements for illegal access to AI models that Okta located on underground forums and messaging platforms.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadCloudflare's mixed response to Poison Claude domains
Poison Claude's main domain, poison-claude.bitsender[.]top, is hosted behind Cloudflare's CDN to conceal an originating IP address. After responsible disclosure, Cloudflare placed a phishing warning in front of that site, Okta said, but appears to have "declined to take action" on the API domain. The API domain uses Cloudflare Turnstile for bot protection.
Ecomagent.in and a growing gray market for model access
Okta's report identifies a similar gray-market service, Ecomagent.in, which is estimated to have nearly 970 users and claims to offer discounted access to Anthropic's Opus 4.8, Opus 4.6, Sonnet 4.6 and OpenAI's GPT Codex 5.5 via a custom API endpoint. These services are presented as ways to bypass cost, access restrictions, or local availability — including demand from regions where U.S.-based LLMs are banned or inaccessible, Okta noted.
Privacy and operational risks: prompts, fraud, and model substitution
Okta highlighted several risks intrinsic to gateway-proxy services. "When services are configured as a gateway proxy, the service provider has full visibility into prompts, as those prompts must be forwarded to a model," the company wrote, calling it a privacy concern because the provider "could accidentally leak or sell data." Other hazards include model providers cutting off access to fraudulent accounts, and service operators advertising a frontier model while routing traffic to a less capable or cheaper model.
Okta also documented abuse of free trials to create synthetic identities at scale using disposable domains such as dakaka[.]org, emailinbo[.]live, and ratixq[.]com. The researchers reported that "bot activity is rising across the internet" and warned that operators of bot networks increasingly use residential proxies to bypass detection, making it riskier for defenders to deploy blunt IP-based blocking.
What this means for technologists, enterprises, and end users
- Technologists and security teams: watch for proxy-style API keys and unexpected environment-variable instructions in onboarding flows; the gateway model gives the intermediary full access to prompts and responses.
- Enterprises and procurement leaders: be aware that discounted API access offered off-platform can be routed through pooled accounts and financed with free-trial credits; such setups risk sudden interruptions if model providers cut access or if the intermediary substitutes a lower-grade model.
- End users and developers: paying in cryptocurrency and switching environment variables to point at third-party APIs can expose prompts and data to the intermediary and create provenance and compliance questions you cannot see from your client.
Anthropic has separately accused DeepSeek, Moonshot AI, and MiniMax of industrial-scale campaigns to extract Claude's capabilities, and Reuters has reported that Chinese military researchers have used models developed by OpenAI and Anthropic to train domestic systems — details Okta cites as context for a growing market that routes U.S.-based LLMs into regions where they are restricted or hard to reach.
The immediate record is granular: a named gateway offering pooled, discounted access; an exposed API endpoint with nearly 900 active users; parallel services claiming similar access; and warnings that proxy gateways hand prompt visibility to their operators. The facts leave a clear question for platforms and hosts: when a public-facing portal is flagged and its API remains reachable behind a CDN, who — and how quickly — will close the path that hands confidential prompts to intermediaries?
