Poison Claude, an unauthorized AI access service, allegedly uses fake cloud accounts and promotional credits from dubious sources to offer Anthropic-compatible API access at significantly reduced rates, according to Okta Threat Intelligence. The operation highlights the emergence of fraudulent networks around emerging AI models, where automated signups, stolen or synthetic identities, cloud trial credits, and cryptocurrency payments are combined to create discounted access services. Poison Claude Exploits Fake Accounts and Free Credits According to the researchers, customer prompts were processed by Poison Claude's infrastructure, while users received API keys compatible with Anthropic tools.
Documentation reportedly instructed customers to modify environment variables so that Claude Code would use Poison Claude’s endpoint instead of a legitimate provider’s API.
A test response revealed potential use of Google Vertex AI within the Gemini Agent Enterprise Platform, though subsequent tests did not replicate the indicator. Okta observed an AI video provider receiving over 105,000 suspected bot-driven signup attempts from 251 IP addresses between June 2023 and July 2026. Recommended mitigation strategies include bot protection, progressive profiling, risk-based network controls, identity verification for high-risk registrations, and short-lived OAuth tokens rather than indefinitely reusable static API keys.
Implement in-browser data inspection from ANY.RUN to detect, investigate, and respond faster, enhancing your SOC and reducing Mean Time To Resolution (MTTR).
