Frontier model access is expensive enough that a market has grown up around getting it cheaper. Some of that market is legitimate open-source tooling. Some of it is outright criminal. From the outside they can look similar, because both sit between your coding agent and a model.
The difference is not the price. It is whether the machine in the middle belongs to you.
What the researchers found
On 5 August 2026, The Hacker News reported on an Okta analysis by Jeremy Kirk and Mathew Woodyard describing more than half a dozen services advertising illegal model access on underground forums.
One of them, Poison Claude, sells access to Anthropic models at 5 to 15 percent of the official per-token price. The funding mechanism is theft of a specific kind. According to Okta, the service takes advantage of free bonus credits, such as the 100 dollar AWS bonus credit on Bedrock accounts. The operators state the mechanism on their own site: “We add those accounts to our pool, your request is routed to a specific account under the hood (you don’t see this), and you get charged 5-15% of the official per-token price depending on the model.”
Payment is in cryptocurrency. Customers receive an API key and set environment variables so their coding agent talks to the service instead of the model provider. A configuration error briefly exposed a status endpoint showing 881 total and 872 active users, a snapshot rather than a maintained figure. The same reporting describes a comparable grey-market service, Ecomagent.in, and puts it at nearly 970 users, without stating who produced that estimate.
Why a gateway proxy sees everything
Okta states the structural point plainly: “When services are configured as a gateway proxy, the service provider has full visibility into prompts, as those prompts must be forwarded to a model.”
That is worth reading twice, because it is not an accusation. It is a description of how the plumbing works. If your prompt has to travel through someone else’s server to reach a model, that someone can read it. No malice is required, and no breach has to occur. Visibility is the default state of the architecture.
Okta’s stated concern follows from that: the service provider “could accidentally leak or sell data.” Could. Neither Okta nor the reporting claims that any of these operators has been observed harvesting or selling customer prompts. What is documented is the capability, not the act, and the difference between those two is exactly where sloppy coverage goes wrong.
The distinction that actually matters
It is tempting to fold every cheap-access tool into the same story. That would be wrong, and the contrast is instructive.
Take Free Claude Code, an MIT-licensed open-source project on GitHub with roughly 47,000 stars. It also sits between your agent and a model, and it also exists to lower cost. But it runs as a local proxy on your own machine, binding to 127.0.0.1, using API keys you create yourself with providers you choose. The project describes its providers as terms-of-service friendly, states that it removes integrations if they stop being permitted, and notes that it is independent and not affiliated with or endorsed by Anthropic.
Same shape on a diagram, opposite privacy posture. In the local case, no third party is in the path at all, because the proxy is running on your hardware under your credentials. In the hosted case, every prompt crosses infrastructure controlled by someone whose business model is built on stolen credits.
So the useful question when someone offers you cheaper access is not whether a proxy is involved. It is: whose computer is it, and whose account pays the provider?
What this costs you if you get it wrong
For an individual developer, routing prompts through an unknown gateway means handing over whatever is in those prompts. For anyone working on unreleased product plans, customer data, or internal code, that is a disclosure with no contract behind it and no way to audit what happened next.
There are second-order risks the researchers list too. Providers may cut off fraudulent accounts, which means the service can vanish. And a service can advertise a frontier model while quietly serving something cheaper and weaker, since the customer has no way to verify which model actually answered.
The marketing content angle is smaller but real. If your team runs competitive research, positioning drafts, or unpublished campaign material through an assistant, the question of who else can read that material is a business question before it is a security one.
What to check
Find out where the proxy runs. If the setup instructions point at an address on your own machine and ask for your own provider keys, nobody else is in the path. If they hand you a key to a remote endpoint, someone is.
Find out whose account is billed. A service charging a small fraction of list price is either subsidising you, reselling something weaker, or spending credits that are not theirs.
Ask what your prompts contain before you decide it does not matter. Most teams underestimate this, because the sensitive material is rarely in the first prompt. It is in the follow-up, where you paste the actual file.
Sources
- The Hacker News, “Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt”, 5 August 2026: https://thehackernews.com/2026/08/poison-claude-sells-discounted-claude.html (retrieved 23 August 2026). Source of the Okta findings, the pricing and bonus-credit mechanism, the quoted operator statement, the user counts, and the gateway-proxy quotation.
- Free Claude Code repository, https://github.com/Alishahryar1/free-claude-code (retrieved 23 August 2026). Source of the licence, the star count, the local proxy address, and the project’s own statements on provider terms and its independence from Anthropic.
