Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt
Summary
Cybersecurity researchers discovered illegal services like Poison Claude that sell discounted access to Anthropic's AI models by exploiting free AWS credits and routing user requests through their servers. A major privacy risk is that these proxy services can see all customer prompts and inputs, since they must forward them to the actual AI model to get responses back.
Solution / Mitigation
A configuration error exposing Poison Claude's API status endpoint 'api.claudeopus[.]shop/api/status' has since been fixed. Following responsible disclosure, Cloudflare placed a phishing warning in front of the main Poison Claude domain, though it declined to take action on the API domain itself.
Classification
Affected Vendors
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://thehackernews.com/2026/08/poison-claude-sells-discounted-claude.html
First tracked: August 5, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 95%