That Cheap Claude API Might Not Be Claude

I'm always looking for a better deal on Claude tokens. There's a whole market for it. Some sites sell seats on shared Claude chat accounts. Others sell API keys well below Anthropic's prices.

I thought it was a few side hustles. Then I watched Wes Bos shop this market on Syntax. It's much bigger than I imagined, with storefronts, review sites and price rankings.

Those prices only work a few ways. The "Claude" you buy may not be Claude. If it is, the account behind it is often farmed or stolen, and your prompts are being sold too.

How the market works

Sellers run proxies called transfer stations. You point your tools at their server instead of Anthropic's. They forward your requests through accounts they control. You never need an account of your own.

Researcher Zilan Qian documented the setup. Sellers advertise openly on GitHub, Telegram, X and online marketplaces. Directories rank them by price. Prices run 70 to 90% below list.

Nobody resells a frontier model at 10 cents on the dollar out of kindness. The margin comes from somewhere.

The "Claude" you buy may not be Claude

A different model. Ask for Opus and you may get Sonnet, Haiku or another vendor's model, relabeled. Token counts can expose a swap to another vendor. A swap between Claude tiers is harder to spot. A seller charging 10% of list for real Opus has to make up the gap somewhere. Swapping the model is the easiest way.

Someone reading your prompts. Every request runs through a server you know nothing about. Qian found signs this data is being resold, for model training and fraud, though no one has proven it at scale yet.

Anthropic's own reports show where some of it goes. In February it said three labs ran 16 million exchanges through about 24,000 fake accounts to copy Claude. One proxy network ran over 20,000 accounts at once and mixed that traffic with paying customers. In June it reported 28.8 million more exchanges from another lab. By September the count was seven labs.

The paying customers are the cover.

Where the cheap tokens come from

Most sellers handle one or two links in the chain. Upstream, operators bulk-register accounts to farm free credits, abuse corporate discounts, or split one $200 Max plan across dozens of users.

Stolen keys fill the gap. Security researchers call it LLMjacking. Stolen credentials resell at 40 to 60% below list, and the victim pays the bill.

Bans barely slow it down. When one account gets cut off, the seller switches to the next.

Why this lands on IT's desk

I work in IT governance, so this worried me more than it tempted me. Agentic coding burns tokens, and pricing is moving to metered usage. GitHub moved Copilot to usage-based pricing this year. If a 90% discount is one search away, someone on your engineering team will try it.

That puts source code, secrets and customer data in the hands of an unknown third party. No contract, no DPA, no audit trail. Possibly stolen credentials. A model you never approved.

SaaS discovery won't catch it. There's no new app, no SSO login, no OAuth grant. A developer sets ANTHROPIC_BASE_URL and Claude Code sends everything to the proxy. Cursor and Cline have similar base URL settings.

What I'd do

1. Inventory AI endpoints. Pull base URL settings from developer machines. Anything off the approved list is a finding.
2. Allowlist at egress. Alert on AI API traffic to unknown hosts.
3. Check expenses. Small recurring charges to unknown AI resellers are the cheapest signal you'll get.
4. Protect your own keys. AI credential theft rose 376% from Q4 2025 to Q1 2026. Scan, scope and rotate.
5. Make the approved path easy. A sanctioned gateway with team budgets removes most of the reason to shop around.
6. Put it in policy. Name approved providers and endpoints so a finding has consequences.

Someone pays for a token sold at 10% of list. Usually it's a farmed account, a stolen key or the buyer's own data.

I'm still hunting for deals. Now I stick to prompt caching, batch pricing and volume terms from Anthropic, where I know which model answered.