Security2 publishers2 min readPublished
Credential-pooling relays are reselling frontier-model access to users the providers never see
Team Cymru counted more than 10,000 self-hosted LLM gateways fronting traffic out of China. They pool accounts behind keys of their own, so the model provider logs the relay's address and never the user's.
The Watch · Security desk
What happened
- Team Cymru said in research dated September 22, 2026 that it had found more than 10,000 hidden LLM gateway servers masking activity originating in China and bypassing AI providers' region bans.
- Its researchers analyzed a sample of 100 of those servers and found them relaying traffic, mostly from China, to larger Western AI services.
- Some clusters in that sample were bypassing region bans and others looked to the researchers like they were running distillation attacks against frontier AI labs.
- The relay toolkit, sub2api, has been forked over eight thousand times and its Telegram channel has almost seven thousand subscribers, which Team Cymru reads as a mature and widely adopted suite.
- Two of the project's listed sponsors sell frontier-model accounts, which Team Cymru says they obtain by exploiting promotional offers and possibly by stealing credentials or tokens.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- capability A relay with per-user billing and a subscription-to-API converter lets someone buy metered frontier-model capacity without ever holding an account with the provider or a presence outside a restricted region.
- constraint Enforcement built on the account cannot reach the person sending the prompt, so providers are left policing relay hosts and IP ranges instead of users.
- exposure Companies that run their own gateway to cut token costs share software and traffic shape with the abusive population, and some malicious relays exist specifically to sit in that caching path and harvest responses.
- contradiction Team Cymru presents the whole 10,000-plus as masking malicious activity, while the Risky Business account of the same research treats this proxy class as ordinary corporate infrastructure, leaving the criminal share of the population unsettled.
The station keeps a pool of upstream credentials, either API keys or logged-in consumer subscription sessions, and re-exposes them behind keys it issues itself [6]. Users authenticate to the station. It authenticates to the model provider, which logs the station's credentials and IP address and never sees the user's source IP [7]. Team Cymru's argument is that account attribution, usage metering and behavioral controls all bind to the identity the provider can see [5].
sub2api ships with user management, per-user billing, a subscription-to-API conversion layer and a prompt-audit subsystem [9]. The conversion layer takes a flat-rate consumer plan and re-serves it as metered API capacity. The billing module charges the station's own customers for it [9].
Both accounts hedge on the theft of model outputs. Team Cymru writes that the servers "potentially siphoned proprietary model outputs" [1]. Risky Business, describing the same research, says some clusters "looked like they were carrying out distillation attacks" against frontier AI labs [4]. Neither publishes a confirmed case. Distillation itself is simple: query a stronger teacher model at scale, keep the outputs and train a cheaper student on them, which is cheaper than building the capability, and which the major providers prohibit in their terms [15].
The behavioral findings come from 100 servers, about 1% of the 10,000-plus Team Cymru counted [1]. Risky Business notes that this class of proxy is normally corporate kit, used to cache AI queries and cut token costs [16], and that most of the servers in the study ran a handful of open-source gateway packages [19].
Fifteen of the 26 listed sponsors are API relay resellers, about 58% of the list [2]. Seven are residential proxy vendors, one is a media-generation API, and one is a CDN that describes itself as "purpose-built for large-scale AI API traffic, deeply optimized for relay services" [12][14].
Beyond region evasion, Risky Business reports the relays being used to hide activity from hacked AI accounts, mask a user's real location, and power illegal services including nudify apps [17]. A separate set intercepts legitimate AI caching traffic to inject their own queries and harvest the responses [18]. Team Cymru says its findings let customers and partners detect and stop the abuse, and avoid compliance and IP exposure [20]. Revoking a pooled key takes out a station's whole customer base at once, until the operator loads a replacement from one of the sponsors that sells frontier-model accounts [13].
What to watch
- Whether frontier providers begin blocking by hosting ASN and gateway fingerprint, and what that does to companies running the same software for token caching.
- Whether the sub2api repository and its Telegram channel stay up now that the project has been named in published research.
- Whether Team Cymru or anyone else publishes a confirmed distillation case rather than cluster behaviour that resembles one.