Poison Claude: The Discount That Reads Everything You Type

Someone on a team finds a service online offering access to Anthropic’s Claude models at a fraction of the normal price. No contract, no sales call, just an API key and a link to swap into their existing tools. It looks like a smart way to save the company money.

Okta’s threat intelligence team documented exactly this kind of service in a report called “Free Tokens for Sale.” The service is called Poison Claude, and once you understand how the discount works, the deal looks different.

How a 90 Percent Discount Gets Built

Poison Claude sells access to Claude on cybercriminal forums, paid in cryptocurrency. Buyers get an API key and a short set of instructions for pointing their tools, often coding assistants and developer pipelines, at Poison Claude’s servers instead of Anthropic’s. The service advertises the same AI response, priced at somewhere between 5 and 15 percent of the normal rate, though that claim comes from Poison Claude’s own marketing rather than independent verification.

The discount comes from a legitimate perk turned into a supply chain. Amazon Web Services gives new users of Bedrock, its service for accessing AI models like Claude, 200 dollars in free credits to try it out. Nothing technically stops someone from creating that account over and over with disposable email addresses. A hundred fake accounts yields 20,000 dollars in free access. A thousand yields 200,000 dollars. Poison Claude’s own website describes the mechanism plainly: incoming requests get routed to whichever fraudulent account still has credit left, and the customer never sees which one.

A similar operation called Ecomagent runs the identical play against Google Cloud, which offers qualifying AI startups up to 350,000 dollars in credits. Ecomagent's existence turns this into a business model, one already running on more than one cloud provider at once. Nicolas Christin, a professor at Carnegie Mellon University who has spent years studying underground markets, has documented exactly this pattern at scale. His research on online criminal marketplaces found that cybercrime increasingly gets packaged and sold as a capability by specialized suppliers, which lowers the bar for entry and helps the whole model grow. Poison Claude and Ecomagent fit that pattern closely: the original fraud gets packaged into something that looks like an ordinary subscription, and everyone downstream simply pays for API access.

Why the Deal Is Genuinely Tempting

A 90 percent discount on a tool people already want to use is a good deal, full stop. Employees are more likely to reach for something priced like that than something that needs justifying on a company card, and that’s simply an understandable response to a bargain. Anyone in finance or procurement can appreciate the logic, even before they know how the discount gets manufactured.

Lorrie Cranor, who directs the CyLab Usable Privacy and Security Laboratory at Carnegie Mellon University, has spent decades studying exactly this kind of tradeoff. As she put it, “building in good security that is also easy to use might be more expensive. While consumers may want it, they may or may not be willing to pay a lot more for it.” Cost and convenience pull people toward the cheaper option, and pretending otherwise doesn't help anyone build a better policy.

What Passes Through Poison Claude’s Servers

Here’s the part worth sitting with. Every prompt sent through Poison Claude travels to its servers first, gets forwarded to Claude, and the answer travels back the same way. Poison Claude sees every message that passes through, whether that’s a line of code, a contract draft, or a customer’s personal information.

Sitting in the middle of that exchange means Poison Claude can do more than read what passes through it. A proxy in that position could just as easily alter a response on its way back, inserting a subtly modified code suggestion or a manipulated answer, and the customer would have no way to tell the difference from a genuine one. Okta’s report is about the exposure risk, what Poison Claude can see. But there’s a second risk sitting right next to it, what Poison Claude could change. Both problems come from the same design choice, since every request has to pass through someone else's server before it reaches Claude.

Okta’s researchers also found an exposed API endpoint belonging to Poison Claude, which revealed the service was running out of a web hosting provider in Mumbai and leaked information about its own paying customers in the process. Whether that specific endpoint has since been locked down isn’t clear, which is itself a reason to treat this as a live concern rather than a closed case. A service willing to create thousands of fraudulent accounts to get its compute for free gives its customers little reason to expect careful treatment of their data once it arrives.

There’s also a simpler problem underneath all of this: the entire scheme runs on stolen cloud credits, and Amazon and Google both actively hunt for and shut down fraudulent accounts. Any team relying on Poison Claude should expect the service to disappear without warning, mid-project, with no support line to call when it does.

The buyer here is simply a customer of a company with no track record, and evidently no habit, of protecting what gets typed into it. Bruce Schneier, a lecturer in public policy at Harvard Kennedy School, has written about exactly why that gap matters more than anonymity itself: “The problem isn’t anonymity; it’s accountability. If someone isn’t accountable, then knowing his name doesn’t help.” Poison Claude’s identity is fully out in the open. Its accountability is the missing piece, and that gap is the risk worth focusing on. This framing matters for how a security team responds, since visibility and clear policy are what solve this.

What Closes the Gap

• Visibility comes first. Most organizations don't have a clear picture of which AI tools employees are using day to day, and that picture is the single most useful thing to build before anything else. Think of it as a discovery exercise, the kind that builds understanding rather than triggering a crackdown.
• A short, clear policy on which AI tools are approved removes the guesswork. When employees know what’s sanctioned and have a fast way to request something new, there’s less reason to go looking for a workaround on their own.
• Data processing agreements deserve the same attention as price. Before adopting any AI service, discounted or not, it’s worth confirming where data goes, who can see it, and whether a proper agreement exists to back that up.
• A CASB or secure web gateway that inspects outbound traffic against a list of approved AI domains adds a second layer of certainty. Traffic quietly flowing to an unfamiliar AI API endpoint from a developer laptop or a CI pipeline is a specific, detectable signal, and it’s worth building an alert around it the same way a security team would flag traffic to any other unapproved destination.
• Most companies already have rules about what goes into an email or a shared drive. Extending that same governance to AI prompts closes a gap that’s easy to miss simply because the tool is new.
• Above all, make it easy to ask. An employee who finds a deal like this one and wants to check whether it's safe should feel entirely comfortable raising a hand and asking the question out loud.

Building This Together

At Adaptive Security, this is the exact gap our AI governance tools are built to close, giving security teams visibility into which AI services employees are using before an unvetted one ends up handling sensitive data. A steep discount on a tool people already want is a signal worth reading closely, a reason to understand what’s underneath the price tag before company data goes through it.