A clandestine online service called Poison Claude is profiting from reselling Anthropic’s premium AI models for a substantial discount. This thriving gray market caters to users who cannot afford official pricing or are blocked by government restrictions, including many in China facing prohibitions on U.S. AI tools. Okta Threat Intelligence uncovered that Poison Claude, hosted at poison-claude[.]bitsender[.
]top, openly advertises “unlimited” tokens through prompt-metered plans and bundled token packages. It offers access to Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6, accepting payments exclusively in cryptocurrencies like Tether, USD Coin, Ethereum, Litecoin, and Bitcoin.
The site’s marketing explains the scheme simply: operators accumulate AI provider accounts using sign-up bonuses such as Amazon’s $100 AWS Bedrock credit, then route customer requests through whichever account has remaining credits. Poison Claude isn't unique; another service, Ecomagent.in, provides discounted access to Opus and Sonnet models alongside GPT Codex 5.5 via an exploit of Google Cloud's startup credit program. Okta Threat Intelligence independently tracked over 105,000 fraudulent sign-ups against an AI video platform's free trial, originating from 251 distinct IP addresses linked to virtual private networks (VPNs) and residential proxies concentrated in Lebanon, Indonesia, and Thailand.
