Poison Claude: the hidden risk of third-party AI API proxies
On August 5, 2026, Okta researchers Jeremy Kirk and Mathew Woodyard published findings on a shadow API service called Poison Claude. The service sells access to Claude models at 5-15% of Anthropic's official per-token price, using a pooled stack of stolen and bonus AWS Bedrock credentials. The catch: the operator routes every request through their own infrastructure and can read every prompt in plaintext before passing it to the underlying model. If your developers are using a third-party "cheap Claude" wrapper, they are handing your organization's data to an unknown operator.
How Poison Claude works
The service operates by exploiting a structural feature of cloud provider first-use credits. AWS offers a $100 first-use credit for Bedrock accounts. Poison Claude creates Bedrock accounts at near-zero cost, adds them to a routing pool, and serves customer requests through these accounts until each account is flagged or exhausted. The economics work at scale: with many accounts cycling through the pool, the operator can offer dramatically lower prices while keeping the service functional. The operator's infrastructure sits between the customer's application and Anthropic's API.
Customers receive an Anthropic-compatible API key and are instructed to set their ANTHROPIC_BASE_URL environment variable (or equivalent configuration) to point at Poison Claude's endpoint instead of api.anthropic.com. For most developers integrating LLMs, that is a one-line configuration change. It is also exactly the kind of change that does not get reviewed in security audits.
Why this is a security problem, not just a terms-of-service problem
Anthropic's terms of service violation is the least important part of this story. The real issue is that every prompt your developers send through a Poison Claude endpoint is readable by an unknown operator in plaintext. Prompts sent to LLM APIs often contain sensitive context: system prompt logic, customer data, internal documents, database query results, and in agentic workflows, live tool call outputs. An operator running a prompt-reading proxy can passively harvest all of that without any active attack.
This is a supply chain trust failure at the AI layer. Developers choose third-party API wrappers for the same reasons they choose third-party npm packages: convenience and cost. The difference is that a malicious npm package requires active exploitation, while a malicious API proxy requires only passive observation. The operator does not have to do anything unusual. They just read the log.
What to check in your organization right now
Search your codebase and infrastructure configuration for non-official Anthropic API base URL settings. The official endpoint is api.anthropic.com. Any other value for ANTHROPIC_BASE_URL, ANTHROPIC_API_URL, or equivalent configuration keys should be treated as a red flag until explained. Expand the search to OpenAI-compatible client libraries, since Poison Claude provides an OpenAI-compatible interface and could appear as a custom OPENAI_API_BASE value. Review any third-party AI API services your teams have subscribed to independently, particularly services marketing unusually low per-token pricing.
The longer-term fix is policy: establish that AI API providers must be on an approved list, and that API endpoint configuration changes must go through the same review process as any other external service integration. Third-party AI API proxies are not a fringe concern. As AI model pricing drives developers toward cost optimization, the attack surface for prompt-reading proxies will grow.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are reviewing AI API security posture for your organization.