In recent times, cybercriminals have heightened their focus on enterprise AI assets, including credentials and cloud environments, to enhance their own uses of AI. A concerning trend has emerged involving the use of proxy servers, referred to as transfer stations, which allow these actors to obscure their origins while exploiting frontier AI models.
Last week, Team Cymru, a security firm, reported that these transfer stations are now a significant part of the landscape, with their investigation revealing a staggering increase from 10,867 to over 80,000 such servers linked to popular open-source relay platforms like Claude Relay Service (CRS) and its successor, sub2api.
According to Scott Fisher, a senior principal engineer at Team Cymru, “A transfer station disrupts the foundational assumption that the account making a request belongs to the user consuming the response. Our findings unearthed a system meticulously crafted to contravene the terms and conditions of frontier model providers, facilitating fraudulent activities.”
These proxy services grant customers access via their own accounts while connecting to upstream AI services through a pool of API keys or subscriptions often acquired through nefarious means such as credential theft.
Research has traced multiple clusters of proxy server activity back to IP addresses located in China and Hong Kong. Given that a significant portion of these gateways are based on U.S. VPS services, it suggests an intent to obfuscate traffic origins, likely to enable model distillation attacks—an operation where targeted prompts are used to harvest model knowledge for the enhancement of other AI systems.
All prominent frontier labs have reported incidents involving distillation attacks against their platforms. Recently, the NSA, CISA, and FBI even released an advisory accusing several China-based AI corporations of conducting large-scale distillation of U.S. models using these malicious transfer stations.
Yet model distillation isn’t the only malicious application for these servers. In August, Palo Alto Networks drew attention to a surge in AI token-jacking incidents, where compromised API tokens and subscription credentials were exploited via transfer stations, resulting in substantial financial losses for victims. Attackers typically harvest credentials from privileged enterprise developer accounts through means like phishing or supply-chain compromises.
Further investigations into infostealer data dumps by Okta Threat Intelligence revealed the collection of 561 Anthropic session tokens from 5,871 infected devices, some of which were still active upon analysis. Additionally, the findings included 24 valid API keys for various AI services such as Gemini and OpenAI, alongside tools designed to sift through stolen browser data for AI-service sessions.
A Commercial Relay Ecosystem
The relay packages identified in Team Cymru's initial findings, CSR and sub2api, were both developed by Wei-Shaw and are available on GitHub. The sub2api project alone has been forked over 8,000 times, and its Telegram channel boasts nearly 7,000 subscribers. Interestingly, the project’s GitHub page lists 26 commercial sponsors, including API relay vendors, residential proxy services, and a media-generation API service.
Palo Alto Networks also detected transfer stations using alternative open-source platforms like new-api and one-api, with many advertisements for these services appearing in Chinese-language online marketplaces such as Taobao.
China-Linked Traffic
Team Cymru closely examined a network of servers located on various U.S. VPS providers and identified more than 4,000 IP addresses from China and Hong Kong connecting to 304 transfer stations. In a short span, these IPs transmitted approximately 14TB of data to the relays and received a notable 7TB.
The relays directed traffic to both domestic Chinese AI platforms—including DeepSeek, Qwen, and ByteDance’s Doubao—and to well-known Western providers like Anthropic, OpenAI, and Google. However, traffic directed to the Chinese services was primarily download-heavy, while uploads to the Western providers dominated the dynamics.
For instance, seventeen relays utilizing Anthropic’s API uploaded around 81GB while receiving only about 1.4GB, implying a significant disparity that could represent between 16 to 23 billion input tokens, pointing towards potential automated querying for model distillation practices.
While Team Cymru couldn’t access the actual prompts or responses, the unusual data transmission patterns were indicative of targeted extraction efforts. Joe Brinkley, head of offensive security at Cobalt, articulates, “Inference endpoints are live production attack surfaces. If providers want to secure their models from extraction, they need to protect them at the application layer with real behavioral telemetry and output controls, rather than relying solely on policy compliance.”
Protecting AI Credentials
Organizations are advised to handle their AI model credentials with the same scrutiny applied to other sensitive production secrets. Transitioning from long-term static keys to short-lived credentials wherever feasible is one recommended strategy. Additionally, implementing configured spending limits and monitoring for unusual account activities can help enhance security.
Security teams should routinely scan for exposed AI credentials across repositories, containers, and application packages. Ideally, long-lived credentials should be stored securely outside of agent sandboxes, and temporary tokens should be generated and injected into workflows only when necessary.
Finally, organizations must incorporate incident response plans that prioritize immediate revocation and rotation of AI credentials, along with the invalidation of any active session tokens linked to compromised accounts. This layered approach can significantly augment defenses against the emerging threats posed by proxy server networks in the AI ecosystem.
