Poison Claude: 881 Users Exposed as Operator Logs Every Prompt

Okta Threat Intelligence researchers Jeremy Kirk and Mathew Woodyard have uncovered a gray-market AI service called Poison Claude that sells deeply discounted access to Anthropic's flagship large language models—including Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6—for just 5–15% of official per-token pricing. Advertised on underground cybercrime forums and messaging platforms, the service sustains its cut-rate model by abusing free credit programs like AWS Bedrock's $100 sign-up bonus, pooling customer requests through fraudulently provisioned Anthropic accounts without the user's knowledge. Once payment is made in cryptocurrency, buyers receive an API key compatible with Anthropic's interface and are told to reroute their Claude Code environment variables to the Poison Claude endpoint, meaning every prompt they send is silently relayed through the operator's own accounts.

A misconfiguration on the service's api.claudeopus[.]shop/api/status endpoint exposed the platform's internal user counts before the leak was patched: 881 total users and 872 active subscribers. The main domain, poison-claude.bitsender[.]top, is fronted by Cloudflare's CDN to mask its true origin IP, and while Cloudflare added a phishing warning after responsible disclosure, the provider appears to have declined to act on the API subdomain, which still uses Cloudflare Turnstile for bot protection. Analysts investigating similar gray-market operations can run a WHOIS lookup on these domains to trace registration history, or evaluate the certificate chain with an SSL/TLS checker to spot mismatched or self-signed certificates common to bulletproof hosting setups.

The privacy implications are severe. Okta warns that because Poison Claude functions as a transparent gateway proxy, the operator has full visibility into every prompt and could log, leak, or sell sensitive data including proprietary code, internal documents, and confidential queries. Researchers also flagged a sister operation, Ecomagent.in, serving roughly 970 users with discounted access to Anthropic's Opus 4.8, Opus 4.6, Sonnet 4.6, and OpenAI's GPT Codex 5.5 via the same proxy model. Anthropic and OpenAI may revoke the fraudulent Bedrock accounts at any moment, stranding customers mid-task or—worse—silently substituting a cheaper, less capable model without disclosure. Developers who have interacted with these services should immediately run a privacy checkup on their development environment, rotate any API keys or tokens that were transmitted through the proxy, and audit past prompts for proprietary data that may now sit in a third party's logs.