AI Credential Theft Fuels Massive Proxy Network Exploiting Frontier Models Researchers from Team Cymru have uncovered a vast network of over 80,000 proxy servers, known as transfer stations, designed to obscure the origin of traffic to leading AI models. These relays primarily hosted on U.S.-based VPS services enable threat actors to conduct model distillation attacks, where stolen API credentials and subscription keys are abused to extract proprietary AI knowledge for unauthorized training or resale. The investigation traced activity to IP addresses in China and Hong Kong, with traffic patterns revealing distinct behaviors: Chinese AI services (DeepSeek, Qwen, Zhipu, MiniMax, ByteDance’s Doubao) saw download-heavy interactions, while Western providers (Anthropic, OpenAI, Google, xAI) experienced upload-heavy traffic consistent with automated querying for model extraction. Over an eight-day period in late August, the relays processed 14TB of outbound data and 7TB inbound, with one cluster alone uploading enough text to represent 16–23 billion input tokens. The ecosystem relies on open-source relay platforms like Claude Relay Service (CRS) and its successor, sub2api developed by a GitHub user known as Wei-Shaw which has been forked 8,000+ times and boasts 7,000 Telegram subscribers. The project’s GitHub page lists 26 commercial sponsors, including API resellers, residential proxy vendors, and AI account providers, suggesting a thriving underground market. Credentials are harvested through information stealers, phishing, and supply-chain attacks, with Okta Threat Intelligence identifying 561 Anthropic session tokens from 5,871 infected machines, alongside 24 valid API keys for Gemini, OpenAI, Groq, and OpenRouter. A Chinese-speaking threat actor was observed validating 2,975 stolen credentials from 1,742 hosts, including keys for Gemini (448), OpenAI (254), and Anthropic (176), before funneling them into AI API-reselling gateways. Security experts warn that these relays bypass frontier-model controls by masking the true origin of requests, enabling fraud and policy violations. Scott Fisher of Team Cymru noted that the system "breaks the assumption that the account making a request belongs to the party consuming the answer," while Joe Brinkley of Cobalt emphasized the need for behavioral telemetry, sybil defenses, and output controls to counter extraction attempts. The findings align with broader trends, including Palo Alto Networks’ discovery of similar relays using platforms like new-api and one-api, advertised on Chinese marketplaces such as Taobao. With enterprise AI credentials increasingly targeted, organizations are urged to treat them as high-value secrets, replacing long-lived keys with short-lived tokens, enforcing spending limits, and monitoring for unusual activity.

Russian Threat Actor "Trim" Repurposes AI Models for Automated Cyberattacks A Russian-speaking cybercriminal known as Trim has developed an automated penetration testing tool, AI Pentest Checker, by jailbreaking frontier AI models to bypass security controls. First appearing on a Russian-language cybercrime forum in March 2026, Trim shared techniques to manipulate AI systems like Claude Opus, framing malicious requests as legitimate security research through prompt-based manipulation. The tool integrates offensive security utilities including Nuclei, ffuf, katana, subfinder, and Gitleaks to automate reconnaissance, vulnerability scanning, and exploit reporting. While these tools are commonly used by security professionals, their combination with a jailbroken AI assistant reduces the time and expertise required to execute attacks, from target discovery to polished exploitation reports. Trim’s methods highlight a broader trend: AI is shifting from a mere writing aid for cybercriminals to an operational layer capable of orchestrating multi-step attack workflows. The actor reportedly used Claude Opus for critical vulnerability escalation and another model for generating reports, with claims of leveraging a modified "Fable 5" system prompt though these remain unverified. Security researchers warn that advanced AI models, even with safety controls, can facilitate offensive tasks like vulnerability analysis and exploit development. This case underscores the growing risk of AI-driven cyber threats, including automated phishing, faster exploit creation, and streamlined attack workflows. Organizations are advised to monitor for abnormal reconnaissance activity and secure exposed assets.