Poison Claude: Rogue API Proxy Exposed Prompts of Nearly 900 Users

A service called Poison Claude was reselling access to Claude at 5-15% of Anthropic’s official pricing by routing customer requests through a pool of compromised AWS Bedrock accounts, according to reporting from The Hacker News published August 14. The catch: the service operators had full visibility into every prompt submitted by every user, because that’s how an API proxy works. A configuration error exposed the user database: 881 total users registered, 872 active. A parallel service, Ecomagent.in, was operating on the same model with roughly 970 users and offering discounted access to both Claude and OpenAI’s API.

This is a clean illustration of a threat that predates AI tooling but is newly relevant at scale: the supply chain risk of routing sensitive queries through infrastructure you don’t control and can’t verify.

How the Service Worked

AWS Bedrock’s promotional credit programme gives new accounts $100 of credits. Poison Claude exploited this by creating and cycling through compromised or fraudulently obtained Bedrock accounts, keeping a pool available to route requests as credits were exhausted. From the user’s perspective, they signed up, got API credentials, pointed their application at the proxy endpoint, and got Claude responses at a steep discount. From the operator’s perspective, they had a logging layer sitting in front of every request.

The technical structure is identical to any legitimate proxy or API gateway, except the operator’s interest isn’t reliability, latency, or billing: it’s the data. Proxy operators see plaintext requests and responses before any encryption on the transport layer protects them. There is no technical mechanism preventing this; it’s an inherent property of the architecture.

Cloudflare placed phishing warnings on the service’s main domain, but the API endpoint was protected by Cloudflare Turnstile, which complicated automated takedown efforts and kept the service accessible to users who had already integrated it.

What Users Were Exposed To

Any prompt submitted through Poison Claude should be treated as having been read by the service operators. For developers integrating Claude into applications, that typically includes system prompts, which often contain proprietary instructions, persona definitions, and application logic that organisations treat as IP. For end users of those applications, it includes whatever they typed into the chat or input field.

The range of sensitive information that passes through LLM prompts in 2026 is substantial: legal questions, medical queries, code containing internal logic or credentials, business strategy documents, customer data passed for summarisation or analysis. None of it is encrypted from the proxy operator’s perspective.

The configuration error that exposed the user count is worth dwelling on. Most users of these services never see a breach report because there’s nothing technically wrong from a network standpoint: traffic goes to the proxy, the proxy forwards it, responses come back. The only signal that something is off is the price, which is what makes these services attractive in the first place.

The Broader Pattern

Two confirmed services with a combined ~1,850 users is almost certainly the visible portion of a larger ecosystem. The economics are clear: someone with a pool of Bedrock accounts and a simple proxy setup can generate recurring revenue from developers who want cheaper AI access, with no marginal cost to the operator beyond account acquisition. The data harvested is valuable in its own right or as a basis for training competing models.

This isn’t the first time unauthorized Claude API reselling has appeared. The structural vulnerability is the same one that affects any third-party API wrapper or integration layer: the question of who has access to the plaintext request between your application and the model provider. Official Anthropic API keys go directly to api.anthropic.com. Anything else deserves scrutiny proportional to the sensitivity of what you’re sending.

For enterprise teams deploying AI applications, the relevant control is egress filtering: enforce at the network layer that API calls to AI providers go only to verified official endpoints. Developers who have integrated third-party AI libraries or SDKs without auditing the underlying endpoints should do that audit.

The existing LLM canary token approach, covered in our previous article on detecting prompt theft, provides complementary detection: canary strings planted in system prompts that appear in output indicate extraction. If those canaries were submitted through an unauthorized proxy, the operator would have seen them, which is a different threat model but the same underlying exposure.

References

• The Hacker News — Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt