Criminal AI relays run on the same open-source gateways platform teams deploy for caching

One hundred servers is one percent of ten thousand ^[12]. The directional finding, as reported by the Risky Business newsletter, is that the sampled traffic ran mostly from China into larger Western AI services ^[7]. The count of more than 10,000 relays is enumeration ^[1]. The traffic profile is an inference from 1 in 100, and it transfers to the full population only if those 100 were picked without regard to how they were found.

The legitimate version of this box exists for money. A gateway caches AI queries and cuts token costs ^[3]. Serving a repeat query from cache means storing the prompt and the response where the gateway can read and compare them, and pooling spend across many users means holding the upstream API credential ^[13]. Both properties are what the criminal use wants: a credential pool and an egress address belonging to someone else. Team Cymru reports relays used to hide activity from hacked AI accounts, mask a user's real location, and power illegal services such as nudify apps ^[5].

A second category goes after the caching itself. Some malicious relays intercept legitimate AI caching activity, inject their own queries and harvest the responses ^[6]. The target is a machine that by design holds decrypted prompts and a working key ^[13].

Most of the 10,000 ran on top of a handful of open-source AI gateway projects ^[9]. Some of those projects received donations from illicit service providers, including residential proxy vendors, API relay resellers, and sellers of compromised AI accounts ^[10]. The newsletter does not name the projects or the donors ^[11]. A sponsor list that includes an API relay reseller is not a subtle signal, and unlike most supply chain questions, this one has an answer you can read before you deploy: if the shortlist is three gateways, the funding check is three funding pages.

For the AI providers, the software overlap takes away the cheap discriminator. The corporate caching relay and the criminal relay are running the same builds ^[9][3], so a control keyed on gateway-shaped traffic lands on both ^[14]. The sample gives the labs a reason to build one regardless: some clusters were bypassing region bans, and others looked like they were carrying out distillation attacks against frontier AI labs ^[8].

Team Cymru calls the servers "transfer stations" ^[2]. The name is worth noting only because it obscures the overlap. These are API proxies, relays and gateways ^[2], the same category a platform team stands up to keep its own token bill down ^[3], and in recent months the same category adopted by a part of the criminal underground dedicated to abusing public AI services ^[4].