When you configure an API endpoint for a domestic model in your terminal, or paste a snippet of business code into a web chat, you naturally assume your requests are running in the provider’s own data center. The cursor streams tokens line by line across your screen, everything looks completely normal, but under the hood, your prompt might have just traveled halfway across the globe. The server forwards your prompt verbatim to a top-tier overseas model, waits for it to finish generating, wraps the output in the skin of a domestic model, and hands it right back to you.
To be clear, talking about this isn’t about bashing any vendor, let alone running PR for anyone. None of the companies named in the report have responded, and the attribution is solely Anthropic’s side of the story—so it’s impossible to say for sure right now who is actually doing what. Across the entire chain, from official APIs to gray-market relay services (or relay/transfer stations), the fundamental risk is identical: whatever you send in can leak to an unknown third party at any moment. Don’t treat LLMs like a digital confessional where you can dump whatever internal company stuff pops into your head. Either dig in and understand the service terms and request routing thoroughly, or bypass the middlemen entirely by connecting directly to official APIs or hosting your own gateway. Either approach is far more reliable than assuming a contract will protect you. We’ll get into concrete ways to handle this in later sections.
In September, Anthropic published a threat intelligence report that brought these covert forwarding channels into plain sight. Over a span of just ten days, one domestic team forwarded roughly 300,000 user requests directly to closed-source overseas models, with the vast majority routed to flagship versions of Claude. They cycled through 5380 fraudulent accounts to relay the traffic. Anthropic noted it had no way of knowing whether the end users had ever been informed that remote servers were archiving intercepted conversation logs.
That said, the report actually referred to “associated operators,” and none of the companies called out have responded publicly. Whether this was orchestrated by the LLM labs themselves, or by relay services peddling resold accounts, stolen credentials, or counterfeit servers, currently rests solely on Anthropic’s unilateral account. In its security section, the report also documented a cybercrime group dubbed GTG-50021. They specialized in hawking discounted Claude accounts that were actually fakes; traffic was quietly diverted to other models, while their client tools stole the buyers’ own Anthropic credentials to flip on the black market. The reality of thinking you’re running Model A when you’re actually hitting Model B is something labs, cybercrime rings, and relay services could all be doing—and from the user experience alone, you have no way to tell the difference.
Many assume that paying for a subscription or premium tier shields them from data leaks. The reality is quite the opposite. You pay hard-earned money for the service, yet your real business data flows down this backchannel, serving as free fuel for someone else to train their own models. Using outputs from frontier models to train your own is known in the industry as distillation—and in their eyes, your daily inputs are ready-made springboards for distillation.
When reading this overseas report, you have to take it with a grain of salt. The report came from Anthropic, whose capabilities were being siphoned off in the first place. Only Anthropic can see its backend telemetry, and the numbers inside have never been independently verified by a third party. Moreover, several of the domestic teams mentioned in the report have consistently published research papers and open-sourced their model weights. Anthropic itself included qualifiers in the report, noting, for example, in the Xiaomi case that there was no indication US user data had been exposed.
Even if you cut the report’s numbers in half, the structural issues this pipeline exposes are alarming enough. What everyone assumed was a secure, direct connection has actually been taking an unannounced joyride through public overseas pipelines without any warning whatsoever.
It’s easy to assume that whatever happens to slip into these forwarding pipelines is just public trivia or harmless small talk. Yet the details disclosed in the official report reveal that the channels were teeming with sensitive production data. This wasn’t information stolen by hackers breaching an internal corporate network; it was typed straight into chat boxes by front-line employees going about their daily work.
The report highlights several concrete, real-world examples. An employee at a multinational pharmaceutical firm pasted infrastructure budget spreadsheets covering four locations—Ho Chi Minh City, Kuala Lumpur, Bangkok, and Ljubljana—into a prompt to model project estimates, even leaving a note to have the financial model cleaned up before a Thursday review. Routed through a third-party relay, those detailed financial projections ended up sitting on an overseas server.
Leaks from technical staff were often far more critical. While using AI dev tools to write scripts, developers casually dumped active Telegram bot tokens, Feishu app credentials, and Notion integration keys into the context window, sending live authentication secrets out across external networks. In another instance, a technician at a municipal public security bureau checking travel trajectories pasted citizen national ID numbers directly into the chat prompt to correlate movements with police records—pushing strictly protected internal data completely outside the security perimeter.
The official report noted that hundreds of end users were affected, spanning more than a dozen languages. While Anthropic provided detailed statistics on how many times external models harvested interactions, it never released an estimate of the overall scale of leaked end-user data. There were precise figures for how many times distillation took place, but no one knows how much user data actually leaked. The two sides received starkly different levels of attention.
Beyond the official investigation, an external leak sparked intense discussion. Independent researcher Shou claimed to have purchased a 6TB dump from a broker containing vast amounts of SSH keys, enterprise VPN credentials, cloud platform keys, and GitLab tokens. This remains a single-source claim that hasn’t been independently verified. But whether the seller was a relay operator or an outside party, the market itself clearly exists—and as the counterfeit server case showed, neither buyer nor seller may be who you think they are. More importantly, an academic measurement study published this April had already confirmed the risks of relay services: out of 428 relay services tested, 17 triggered security monitoring probes. The fact that intermediate nodes can inspect your inputs in plaintext has always been an established reality.
Behind every prompt you send to a relay service, multiple monetization channels are quietly running. While many assume their money simply pays for model-generated answers, your inputs actually clear three distinct downstream revenue pipelines: cybercrime, model training, and open data reselling.
The first is landing straight in the hands of malicious threat actors. When observing relay services, that April academic study intercepted 99 sets of system authentication credentials across 440 sessions, totaling roughly 13GB of plaintext traffic. Attackers scan input streams in bulk for credentials, turning them right around as turnkey tools to breach external servers.
The second demand comes from LLM labs eager to boost model capabilities. Anthropic estimated that unauthorized distillation across vendors exceeded 180 million requests, with Alibaba accounting for 151 million, Moonshot around 23 million, and DeepSeek tallying 12.1 million. To filter for high-value data, DeepSeek even inspected incoming requests for tool signatures, routing prompts tagged with Claude Code or OpenCode markers specifically to its reasoning models. Coding agents generate dense chains of reasoning and tool calls—precisely the scarce fuel needed to train coding models. Without realizing it, software engineers writing code every day became the prime target for harvesting.
The third method is even more direct: reselling user conversations as off-the-shelf commodities. Anthropic’s official report explicitly documented this relay service reselling model: operators saved interaction logs to sell to third parties, and teams like SenseTime had purchased data-broker-collected user conversations when building out their pipelines. As early as May, an investigative report by National Business Daily exposed this supply chain of relay services reselling user data—pointing out the industry reality four months ahead of the overseas official report.
The same transmission pipeline, carrying the exact same content typed in by users, smoothly powered three monetization channels without anyone’s consent. On your end of the screen, you pay a small token fee for each API call; on the other end of the wire, your business data has already been cashed out three separate times.
Upon learning their data is leaking out in the wild, most people’s first instinct is to pore over service agreements, believing a signed contract acts as a protective shield. Comparing the actual terms across providers, however, reveals a reality far more permissive than you’d expect. Far from preventing data from flowing under the table, paper agreements often carve out broad loopholes for downstream data processing.
DeepSeek’s privacy policy explicitly states that input data may be used to train algorithmic models, specifically extending this coverage to its API services. Moonshot’s developer agreement similarly stipulates that users grant the platform a royalty-free license to use inputs and outputs for service optimization. For regular users paying for web subscriptions, there isn’t even a toggle in the settings UI to opt out of model training; opting out requires emailing support for manual processing, which takes 5-7 business days to take effect.
Even if users consent to having their data used to improve services, common sense assumes that means optimizing the provider’s own models. Quietly forwarding paying users’ prompts to a competitor’s model for distillation is indefensible by any standard. Moonshot’s documentation states that conversation data will not be shared with, sold to, or provided to third parties outside of user consent, legal requirements, or what is strictly necessary to deliver product functionality. If covert forwarding and data resale turn out to be true, it means they failed to uphold even their own written commitments.
Since contracts can’t be relied upon, the technical defenses rolled out by model providers don’t protect ordinary users either—their sole focus is defending their own proprietary assets. The chain-of-thought protections Anthropic added to Fable 5.1 currently apply only to new API accounts, specifically designed to block competitors from extracting its reasoning process. The long-discussed response signatures still have no deployment timeline, and even then, their primary purpose is verifying whether the returned response was tampered with. Academic research made this abundantly clear: the moment credentials are transmitted to an intermediate node, they are already fully exposed along the request path. Downstream signatures do nothing to protect the input side.
Contracts failed to halt covert data transfers, technical defenses protect outputs while ignoring inputs, and end-user clients are left completely in the dark. With institutional constraints, technical defenses, and user consent failing all at once, every word you send out falls squarely into an unprotected vacuum.
Once you understand how this routing actually works, you have to adopt a realistic defense mindset in your daily development and model usage. The core rule is simple: unless you fully control the entire pipeline yourself, treat every prompt you send as if you were publishing it to the open web—including data you assume is covered by a commercial agreement.
Before integrating any third-party service, ask three straightforward questions: Who has permission to read the entire request payload? How long is that data retained on intermediate nodes? And whom can those archived conversation logs ultimately be sold to? These three questions determine the exact level of exposure your input data faces.
When it comes to everyday engineering practices, three basic rules will keep you out of most trouble: - Never route text containing core business logic or high-value credentials through pipelines you don’t own. - When purchasing enterprise API access, choose commercial tiers that explicitly commit to zero model training and forbid third-party data sharing. Prioritize providers offering Zero Data Retention (ZDR) options; certain custom enterprise tiers from major domestic vendors also guarantee data stays out of training pools. - If you have any doubts about the intermediate transport layer, bypass proxies entirely: connect directly to official native APIs for mission-critical workflows, or build and manage your own gateway on private infrastructure.
That 6TB dataset put up for sale is the market’s real price tag on this security vacuum. Domestic financial media pointed out this ecosystem of relay services trafficking user assets four months ago. Spawned from routine technical interactions, it has already been operating quietly across commercial networks for over half a year.