{"schema_version":"0.10.0","id":"LR-2026-0554","record_version":1,"title":"Chinese grey market resells Claude API access using stolen credentials","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":50.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":3.52,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Tom's Hardware · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Tom's Hardware · subject to change"}]},"sources_hash":"7be662ff3331b60dc2402a08dad9e4f1e21bd41653b68bf3a2f304912df78c88"},"system":{"model_name":"Claude","model_version":null,"developer":"Anthropic","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-05-09","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"A grey-market network of API proxy services in China resold access to Anthropic's Claude models at a fraction of the official price. Upstream operators registered accounts through farmed credits, discounts and stolen payment details. Oxford China Policy Lab researcher Zilan Qian investigated the network, and German researchers at CISPA audited 17 of the proxy services and found widespread model substitution. The operators also collect every prompt and response passing through their servers. Anthropic had blocked Chinese-controlled entities in September and added stricter verification, but the research suggests each new control generated an evasion market. Anthropic had also disclosed in February roughly 24,000 fraudulent accounts linked to Chinese labs.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK03"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Unbounded scope stated: the test for major is an unbounded scope stated, and the source says the operators collect every prompt and response that passes through their servers.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.tomshardware.com/tech-industry/artificial-intelligence/chinese-grey-market-sells-claude-api-access-at-90-percent-off-through-proxy-networks-that-harvest-user-data","publisher":"Tom's Hardware","date":"2026-05-09","type":"press","title":"Chinese grey market sells Claude API access at 90% off by using stolen credentials, model substitution, and harvesting users' prompts and outputs for resale as AI training data — 'transfer stations' operate through proxy networks that harvest user data - Tom's Hardware","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.model_name":"C","system.developer":"C","context.country":"C","event.detection_method":"C","event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"A grey-market economy of API proxy services in China is reselling access to Anthropic's Claude models at as little as 10% of the official price, according to an investigation published Monday by Oxford China Policy Lab researcher Zilan Qian."}],"system.developer":[{"source_index":0,"quote":"A grey-market economy of API proxy services in China is reselling access to Anthropic's Claude models at as little as 10% of the official price, according to an investigation published Monday by Oxford China Policy Lab researcher Zilan Qian."}],"context.country":[{"source_index":0,"quote":"A grey-market economy of API proxy services in China is reselling access to Anthropic's Claude models at as little as 10% of the official price, according to an investigation published Monday by Oxford China Policy Lab researcher Zilan Qian."}],"event.detection_method":[{"source_index":0,"quote":"A grey-market economy of API proxy services in China is reselling access to Anthropic's Claude models at as little as 10% of the official price, according to an investigation published Monday by Oxford China Policy Lab researcher Zilan Qian."}],"event.incident_class":[{"source_index":0,"quote":"Some accounts enter the pool at zero cost, purchased with stolen credit card details, according to Qian."}],"impact.severity":[{"source_index":0,"quote":"The proxy operators also collect every prompt and response that passes through their servers."}],"impact.severity_because":[{"source_index":0,"quote":"The proxy operators also collect every prompt and response that passes through their servers."}],"event.summary":[{"source_index":0,"quote":"A grey-market economy of API proxy services in China is reselling access to Anthropic's Claude models at as little as 10% of the official price, according to an investigation published Monday by Oxford China Policy Lab researcher Zilan Qian."},{"source_index":0,"quote":"Some accounts enter the pool at zero cost, purchased with stolen credit card details, according to Qian."},{"source_index":0,"quote":"German researchers at the CISPA Helmholtz Center for Information Security audited 17 of these proxy services and found widespread model substitution."},{"source_index":0,"quote":"The proxy operators also collect every prompt and response that passes through their servers."},{"source_index":0,"quote":"Anthropic blocked Chinese-controlled entities from Claude access in September and has since added progressively stricter verification, but Qian's research suggests each new control has generated a corresponding evasion market rather than reducing overall unauthorized access."},{"source_index":0,"quote":"Anthropic disclosed similar activity in February, identifying roughly 24,000 fraudulent accounts linked to Chinese labs, including DeepSeek, Moonshot AI, and MiniMax."}]},"notes_on_gaps":"The sources do not describe an autonomous agent being involved, so event.agent_involved, event.failure_class and related agent fields are left out. The sources do not state a precise publication date for the investigation (only 'Monday'), an incident date, a trigger, a root cause, a containment time, a duration, direct loss, or record counts, so these are omitted. Judgement: incident_class set to security_compromise because the incident is resale using stolen credentials; detection_method and responsible_party set to third_party based on the independent researcher and the proxy operators. Judgement: severity set to major on the unbounded-scope test because the source says every prompt and response passing through the servers is collected. The identity-verification evasion (recruiting real people in lower-income countries) is reported but no control entry is made for it because no listed control matches it cleanly. The Tom's Hardware reader comments were not used as evidence. No remediations by the affected parties are stated. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Tom's Hardware · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"CN","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Proxy services in China resold access to Anthropic's Claude models at a steep discount.","quote":"A grey-market economy of API proxy services in China is reselling access to Anthropic's Claude models at as little as 10% of the official price, according to an investigation published Monday by Oxford China Policy Lab researcher Zilan Qian.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Some accounts entered the pool at zero cost, bought with stolen credit card details.","quote":"Some accounts enter the pool at zero cost, purchased with stolen credit card details, according to Qian.","source_index":0,"grade":"C"},{"step":"caught","text":"An investigation by Oxford China Policy Lab researcher Zilan Qian exposed the network.","quote":"A grey-market economy of API proxy services in China is reselling access to Anthropic's Claude models at as little as 10% of the official price, according to an investigation published Monday by Oxford China Policy Lab researcher Zilan Qian.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.tomshardware.com/tech-industry/artificial-intelligence/chinese-grey-market-sells-claude-api-access-at-90-percent-off-through-proxy-networks-that-harvest-user-data"]},"analysis":{"sections":{"timeline":[{"text":"An investigation published by Oxford China Policy Lab researcher Zilan Qian reported the grey-market resale.","quote":"A grey-market economy of API proxy services in China is reselling access to Anthropic's Claude models at as little as 10% of the official price, according to an investigation published Monday by Oxford China Policy Lab researcher Zilan Qian.","source_index":0,"when":"Monday"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.tomshardware.com/tech-industry/artificial-intelligence/chinese-grey-market-sells-claude-api-access-at-90-percent-off-through-proxy-networks-that-harvest-user-data"]}}