A cyber threat dubbed Poison Claude has been identified as a conduit for data harvesting, operating through underground forums to distribute unauthorized access to Anthropic’s suite of large language models. According to The Hacker News, operators of this illicit service maintain direct oversight of every interaction processed by their customers, effectively acting as a bridge that intercepts and logs user prompts before they reach the official AI infrastructure.

The service specifically markets cut-rate entry to a variety of Anthropic models, capitalizing on demand for restricted or premium AI capabilities at a lower cost. Security analysts have observed active advertisements for the following specific model versions being peddled by the service:

Researchers confirmed the identification of more than half-a-dozen distinct services currently promoting this style of illegitimate model access across messaging platforms and various cybercrime forums. By positioning themselves as an intermediary, the operators of Poison Claude are able to capture sensitive inputs, potentially exposing proprietary data, private conversations, or intellectual property shared by unsuspecting users attempting to bypass legitimate subscription channels.

Why It Matters

This incident highlights a growing shift in cybercrime toward the exploitation of LLM infrastructure. Beyond simple account theft, these intermediary services pose a systemic risk to corporate information security. If users inadvertently input confidential business data into a compromised proxy, that information is essentially funneled directly to unauthorized actors. This bypass of official API safeguards renders standard enterprise security controls ineffective, necessitating that organizations prioritize direct integration with established providers to ensure data privacy and prevent supply chain vulnerabilities within their AI development pipelines.