Claude's Chinese Backdoor: Tokens at 90% Off via Shadow Proxies
Anthropic runs what are probably the strictest access controls of any major AI provider. The company checks phone numbers, requires foreign credit cards, verifies billing addresses, and bans any entity with more than 50 percent Chinese ownership. For select users, it mandates identity verification with a government ID and a live selfie.
That system is being systematically bypassed.
Chinese developers are buying Claude API tokens at roughly 10 percent of the official price through a thriving gray market of proxy "transfer stations," according to a detailed analysis by Zilan Qian, a researcher at the Oxford China Policy Lab. The findings, reported by The Decoder, paint a picture of access controls that look comprehensive on paper but collapse under the pressure of a motivated underground economy.
How the transfer stations work
The core mechanism is deceptively simple. Chinese developers connect to API proxies hosted on servers outside China -- typically in Japan, Singapore, or the United States. These proxies accept requests in Chinese yuan via WeChat or Alipay, forward them to Anthropic's API as if they came from a legitimate location, and relay the response back. No VPN, no foreign bank account, no selfie required.
The infrastructure behind this access is a modular supply chain that Qian describes as highly resilient. Upstream, account brokers mass-register Anthropic accounts using stolen or synthetic identities. SMS verification platforms provide foreign phone numbers. Reverse-engineering specialists study Anthropic's detection methods to find new weaknesses. Downstream, developers and resellers market access on Chinese e-commerce platforms like Taobao.
Most participants only operate one or two links in the chain. When a provider gets banned, the upstream account pools and downstream customer bases stay intact. A replacement can be spun up within hours.
Price is the killer feature
The pricing gap is the engine driving the entire gray market. Operators push costs down through a mix of methods: farming Anthropic's free $5 introductory credit across thousands of fake accounts, exploiting enterprise and education discounts, splitting a single $200 Max subscription across multiple users through token quotas, and in some cases using credit cards funded by fraud.
The result: Chinese developers pay roughly 10 percent of the official Claude API price. For a startup or solo developer in China, the official price is prohibitive -- and the gray market alternative works well enough that the risk feels abstract.
The hidden tax: model swapping
There is a catch, and it is worse than most users realize.
Since the proxy sits between the user and Anthropic's actual API, the operator can quietly swap the model being served. A request meant for Opus 4.7, Anthropic's most capable model, can be silently rerouted to the cheaper Sonnet or even to an unrelated Chinese model like Qwen. The Chinese community calls this practice "diluting."
German researchers examined 17 API proxies and found widespread model swapping, according to Qian's report. One endpoint that claimed to serve "Gemini-2.5" scored just 37 percent on a medical benchmark -- far below the official 83.82 percent -- suggesting the user was actually talking to a much weaker model at a premium price.
For a developer building on what they believe is a frontier model, dilution means building on sand. A coding agent that appears to use Opus 4.7 may actually be running on an older or open-weight model -- producing worse code, missing edge cases, and creating a false sense of capability.
Identity checks: already beaten
Anthropic has invested heavily in identity verification. The company requires government ID and a live selfie for certain users. But Qian's analysis indicates that these checks already have established workarounds.
AI services can generate realistic fake identity documents. Deepfake technology is used to defeat biometric facial checks. Where automated forgery falls short, real people in low-income countries are recruited to perform identity verification on behalf of Chinese buyers -- a KYC market with a known precedent.
Qian points to the black market around Worldcoin, whose iris-scan identity system had verification tokens from Cambodia and Kenya traded for under $30 each. The Claude bypass market appears to follow the same playbook.
Data security: the invisible risk
Every request that passes through a proxy is potentially visible to its operator -- prompts, responses, tool calls, and iterations. For coding agents, this can expose entire codebase contexts and workflow patterns. The logs could contain proprietary business logic, unreleased product details, authentication tokens, or personally identifiable information.
For companies, this is the hidden cost of cheap tokens: the proxy provider has full visibility into everything being built.
The broader picture
The Claude gray market is not a small-scale curiosity. Qian describes the user base as extending well beyond individual developers to include Chinese AI labs, university researchers, tech employees, companies, and app makers. Some labs may be using the proxies for distillation -- learning from Claude's outputs to improve their own weaker models faster -- which raises separate questions about intellectual property and competitive advantage.
The architecture that makes the system resilient also makes it difficult to dismantle. Account brokers, proxy hosts, verification platforms, and resellers each operate independently. Taking down one piece leaves the rest intact. And the economic incentive -- access to frontier AI at 90 percent off -- ensures a constant supply of new participants.
Closing
The Claude gray market exposes a hard truth about AI access controls in an interconnected world. The measures that look ironclad in a security presentation -- geoblocking, credit card verification, live selfies -- can be dismantled by a modular underground economy that treats each control as just another API call to bypass.
For Anthropic and the broader AI industry, the question is not whether these controls can be made stronger. It is whether any access control can survive the combination of determined demand, modular infrastructure, and AI tools that are themselves being used to defeat the checks designed to contain them.