Skip to content
Today
Sections

Security Independently confirmed2 publishers 2 min read Published

Credential-pooling relays are reselling frontier-model access to users the providers never see

Team Cymru counted more than 10,000 self-hosted LLM gateways fronting traffic out of China. They pool accounts behind keys of their own, so the model provider logs the relay's address and never the user's.

The Watch · Security desk

Send a correction

What happened

  • Team Cymru said in research dated September 22, 2026 that it had found more than 10,000 hidden LLM gateway servers masking activity originating in China and bypassing AI providers' region bans.
  • Its researchers analyzed a sample of 100 of those servers and found them relaying traffic, mostly from China, to larger Western AI services.
  • Some clusters in that sample were bypassing region bans and others looked to the researchers like they were running distillation attacks against frontier AI labs.
  • The relay toolkit, sub2api, has been forked over eight thousand times and its Telegram channel has almost seven thousand subscribers, which Team Cymru reads as a mature and widely adopted suite.
  • Two of the project's listed sponsors sell frontier-model accounts, which Team Cymru says they obtain by exploiting promotional offers and possibly by stealing credentials or tokens.

Why it matters

  • What's now possible capability A relay with per-user billing and a subscription-to-API converter lets someone buy metered frontier-model capacity without ever holding an account with the provider or a presence outside a restricted region.
  • What it limits constraint Enforcement built on the account cannot reach the person sending the prompt, so providers are left policing relay hosts and IP ranges instead of users.
  • Who's exposed exposure Companies that run their own gateway to cut token costs share software and traffic shape with the abusive population, and some malicious relays exist specifically to sit in that caching path and harvest responses.
  • What doesn't add up contradiction Team Cymru presents the whole 10,000-plus as masking malicious activity, while the Risky Business account of the same research treats this proxy class as ordinary corporate infrastructure, leaving the criminal share of the population unsettled.

The station keeps a pool of upstream credentials, either API keys or logged-in consumer subscription sessions, and re-exposes them behind keys it issues itself [8]. Users authenticate to the station. It authenticates to the model provider, which logs the station's credentials and IP address and never sees the user's source IP [9]. Team Cymru's argument is that account attribution, usage metering and behavioral controls all bind to the identity the provider can see [7].

sub2api ships with user management, per-user billing, a subscription-to-API conversion layer and a prompt-audit subsystem [11]. The conversion layer takes a flat-rate consumer plan and re-serves it as metered API capacity. The billing module charges the station's own customers for it [11].

Both accounts hedge on the theft of model outputs. Team Cymru writes that the servers "potentially siphoned proprietary model outputs" [1]. Risky Business, describing the same research, says some clusters "looked like they were carrying out distillation attacks" against frontier AI labs [20]. Neither publishes a confirmed case. Distillation itself is simple: query a stronger teacher model at scale, keep the outputs and train a cheaper student on them, which is cheaper than building the capability, and which the major providers prohibit in their terms [13].

The behavioral findings come from 100 servers, about 1% of the 10,000-plus Team Cymru counted [22]. Risky Business notes that this class of proxy is normally corporate kit, used to cache AI queries and cut token costs [14], and that most of the servers in the study ran a handful of open-source gateway packages [6].

Fifteen of the 26 listed sponsors are API relay resellers, about 58% of the list [18]. Seven are residential proxy vendors, one is a media-generation API, and one is a CDN that describes itself as "purpose-built for large-scale AI API traffic, deeply optimized for relay services" [4][5].

Beyond region evasion, Risky Business reports the relays being used to hide activity from hacked AI accounts, mask a user's real location, and power illegal services including nudify apps [15]. A separate set intercepts legitimate AI caching traffic to inject their own queries and harvest the responses [16]. Team Cymru says its findings let customers and partners detect and stop the abuse, and avoid compliance and IP exposure [17]. Revoking a pooled key takes out a station's whole customer base at once, until the operator loads a replacement from one of the sponsors that sells frontier-model accounts [21].

What to watch

  • Whether frontier providers begin blocking by hosting ASN and gateway fingerprint, and what that does to companies running the same software for token caching.
  • Whether the sub2api repository and its Telegram channel stay up now that the project has been named in published research.
  • Whether Team Cymru or anyone else publishes a confirmed distillation case rather than cluster behaviour that resembles one.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence52
Adoption74
Hype gap+28
Incentives76
Confidence58
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Team Cymru research dated September 22, 2026 says the firm uncovered 10,000+ hidden gateway servers masking malicious activity originating in China that bypassed AI providers' region bans and "potentially siphoned proprietary model outputs".

    Reported Supported Source: Team CymruView cited source
  2. [2]

    Risky Business reported that researchers discovered more than 10,000 proxy servers masking malicious AI activity originating out of China.

    Reported Supported Source: Risky BusinessView cited source
  3. [3]

    The sub2api GitHub page lists twenty-six commercial sponsors.

    Reported SupportedView cited source
  4. [4]

    The sponsor breakdown is fifteen API relay resellers, seven residential proxy vendors, two AI account providers, one relay-optimized CDN and one media-generation API.

    Reported SupportedView cited source
  5. [5]

    One sponsor is a CDN self-described as "purpose-built for large-scale AI API traffic, deeply optimized for relay services."

    Reported SupportedView cited source
  6. [6]

    Most of the servers ran on top of a handful of open-source AI gateway server software packages.

    Reported SupportedView cited source
  7. [7]

    Frontier-model providers rely on account attribution, usage metering and behavioral controls to detect and limit abuse; relay infrastructure weakens those controls by separating the apparent requestor from the party actually consuming the service.

    Reported SupportedView cited source
  8. [8]

    The transfer station holds a pool of upstream LLM credentials, API keys or logged-in consumer subscription sessions, and re-exposes them behind keys of its own that its users authenticate with.

    Reported SupportedView cited source
  9. [9]

    Users authenticate to the transfer station; the transfer station authenticates to the model provider; the provider sees the credentials and IP addresses of the transfer station and never sees the actual source IP of the user.

    Reported SupportedView cited source
  10. [10]

    Claude Relay Service (CRS 1.x) and its successor sub2api (CRS v2.0) are published on GitHub by author Wei-Shaw in Simplified Mandarin and are widely adopted as proxies to access frontier models.

    Reported SupportedView cited source
  11. [11]

    sub2api includes user management, per-user billing, a subscription-to-API conversion layer and a prompt-audit subsystem.

    Reported SupportedView cited source
  12. [12]

    The sub2api codebase has been forked over eight thousand times and the project's Telegram channel has almost seven thousand subscribers.

    Reported SupportedView cited source
  13. [13]

    In model distillation an actor queries a stronger teacher model at scale, collects its outputs and uses them to improve a cheaper student model at substantially lower cost than developing the capability independently, which is why major frontier-model providers prohibit using their outputs to train competing models.

    Reported SupportedView cited source
  14. [14]

    AI proxies, relays and gateways are typically used in corporate environments to cache AI queries and cut down token costs.

    Reported Supported Source: Risky BusinessView cited source
  15. [15]

    AI proxy relays are being used to hide activity from hacked AI accounts, mask the real location of a user, and power illegal AI services such as nudify apps.

    Reported Supported Source: Risky BusinessView cited source
  16. [16]

    Other malicious AI relay servers are used in schemes to intercept legitimate AI caching activity and inject their own queries and harvest responses.

    Reported Supported Source: Risky BusinessView cited source
  17. [17]

    Team Cymru says the discovery equips its customers and partners to detect and stop the abuse of frontier AI models, preventing exorbitant recovery costs and compliance and IP exposure.

    Reported Supported Source: Team CymruView cited source
  18. [18]

    The fifteen API relay resellers are about 58% of the twenty-six listed sponsors.

    Derived Supported
  19. [19]

    Team Cymru researchers analyzed a sample of 100 servers from the total 10,000 and found they were relaying traffic, mostly from China, to larger Western AI services.

    Reported InsufficientView cited source
  20. [20]

    Some server clusters were being used to bypass region bans, while others "looked like they were carrying out distillation attacks" against frontier AI labs.

    Reported Insufficient Source: Risky BusinessView cited source
  21. [21]

    Team Cymru says the two AI account provider sponsors offer frontier-model provider accounts essential to transfer station operations, and obtain those credentials through illicit means such as exploiting promotional offers and possible credential or token theft.

    Reported Insufficient Source: Team CymruView cited source
  22. [22]

    The 100 servers analyzed are about 1% of the 10,000-plus gateway servers counted.

    Derived Insufficient

Sources

2 independent publishers whose own reporting we read for this story.

  1. news.risky.biz

    1 article · September 22, 2026

    Risky Bulletin: Network of 10,000 AI servers masks Chinese malicious activity

  2. team-cymru.com

    1 article · September 22, 2026

    transfer stations

Topics and entities

Topics

Entities