China’s AI Labs Tapped Claude’s Reasoning Through Secret Proxies

What's the news#

Anthropic’s safety team published a briefing that outlines a months‑long campaign in which several Chinese AI labs accessed Claude through unofficial proxy servers. Rather than using the vendor’s public API keys, these groups set up intermediate machines that forwarded requests to Claude while masking the true origin of the traffic. The proxies asked for chain‑of‑thought explanations, a feature that reveals the internal steps the model takes before delivering an answer. By collecting thousands of such traces, the labs could reconstruct large parts of Claude’s reasoning logic and use that knowledge to train competing models.

The briefing notes that the activity was first spotted through unusual spikes in token consumption from specific IP ranges that did not match any known Anthropic partner. Further investigation revealed that the proxy machines were hosted on low‑cost virtual instances in various cloud regions, often rotating IP addresses to evade simple blocking rules. Anthropic says it revoked the offending API keys, tightened its rate‑limiting algorithms and began logging additional metadata to detect similar behaviour in the future.

Details#

The technical setup was relatively simple yet effective. Operators rented virtual machines from major cloud providers, installed a lightweight forwarding daemon and configured it to send HTTP POST requests to Claude’s endpoint. Each request carried a custom User‑Agent string and a spoofed X‑Forwarded‑For header, making the traffic appear as if it originated from a benign source in Southeast Asia. Because the daemon only forwarded the raw payload, the model’s responses were returned to the proxy, logged locally, and then sent back to the original requester.

What made the operation valuable was the request for "reasoning" mode. When a user asks Claude to explain its thinking, the model returns a detailed trace that shows how it weighed alternatives, applied safety filters and arrived at a final output. Anthropic normally treats this trace as internal debugging information and does not expose it through the standard chat interface. The Chinese labs, however, repeatedly asked for this trace on a wide variety of prompts ranging from technical documentation to hypothetical scenario planning.

Over time, the accumulated traces gave the labs a rich dataset of step‑by‑step decision paths. By feeding these traces into their own training pipelines, they could teach open‑source models to emulate Claude’s chain‑of‑thought style without needing to build a comparable model from scratch. In addition, because the proxies logged the full HTTP request body, they occasionally captured snippets of text that users had pasted into Claude during legitimate sessions. These snippets included fragments of internal memos, source‑code comments and even short briefings that resembled classified material. Anthropic stresses that the model itself does not retain user data, but the act of logging the proxy’s queries unintentionally preserved the text that passed through the network.

When the anomalous traffic was detected, Anthropic’s security team worked with the cloud providers to shut down the offending virtual machines and revoke the associated API keys. The company also updated its abuse‑detection rules to look for patterns such as repeated requests for reasoning traces from the same subnet, unusually high token‑to‑request ratios and rapid IP rotation.

India impact#

Many Indian technology firms rely on Claude for tasks such as automating customer support, generating marketing copy and analysing large datasets. These workflows typically send API calls over the public internet, often passing through the same cloud regions that hosted the proxy machines. While Anthropic encrypts the payload in transit, metadata such as the timing of requests, the size of the payload and the destination IP can still be observed by a node positioned along the route.

If a malicious actor controls such a node, they could log the metadata and, in some cases, attempt a man‑in‑the‑middle attack to capture unencrypted headers. Although breaking TLS would require significant resources, the mere exposure of usage patterns can help an adversary infer what kind of workloads a company is running—for example, whether it is processing financial data, legal documents or engineering schematics.

Companies that use UPI‑linked payment gateways to monetise AI services should be especially careful about where they store their API keys. Hard‑coding keys in mobile apps or exposing them via poorly secured continuous‑integration pipelines creates an easy target for attackers who might then set up their own proxies. Jio’s recent investments in edge‑computing mean that more Indian traffic will stay within domestic data centres, which could be used to host private instances of open‑source models and reduce dependence on external APIs.

From a policy perspective, the incident has prompted discussions in the Ministry of Electronics and Information Technology about requiring foreign AI vendors to offer a data‑localisation option for Indian customers. Such a rule would allow firms to keep prompts and outputs on servers governed by Indian law, thereby shrinking the attack surface for cross‑border snooping. Until such measures are in place, the safest approach for Indian organisations is to enforce strict key‑management practices, monitor outbound traffic for anomalies and consider hybrid setups where non‑sensitive tasks run on local models while only the most complex queries are sent to Claude.

Use cases#

The primary value of the harvested reasoning traces lies in their ability to shortcut the expensive trial‑and‑error phase of training a frontier language model. With a large collection of chain‑of‑thought examples, a research team can:

• Train a smaller model to reproduce Claude’s step‑by‑step logic, achieving comparable performance on benchmarks that test reasoning and instruction following.
• Fine‑tune an existing open‑source LLM to better handle ambiguous prompts, reducing the rate of hallucinations in specialised domains such as legal analysis or medical triage.
• Build a domain‑specific assistant for defence planners that needs to explain why a particular course of action was recommended, thereby increasing trust among human operators.
• Create a code‑generation tool that not only writes syntactically correct code but also provides a clear rationale for each design choice, making it easier for developers to review and maintain.
• Develop a content‑moderation system that can articulate why a piece of text was flagged, helping platforms meet transparency requirements from regulators and users.

Beyond technical applications, the traces could also be repurposed for influence operations. By understanding how Claude crafts nuanced arguments, an actor could generate persuasive narratives that mimic the model’s style while promoting a particular political agenda. The ability to produce explanations that appear logical and well‑structured makes such content harder to dismiss as outright misinformation.

Honest take#

The episode underscores a simple truth: the AI supply chain is only as resilient as its weakest link. Anthropic’s decision to publish the details is commendable because it gives the broader community a chance to harden defences before similar tactics spread further. At the same time, it reveals how eager some organisations are to leapfrog the costly, years‑long process of building a state‑of‑the‑art language model by siphoning the intelligence of an existing one.

For India, the takeaway is twofold. First, there is a strategic imperative to accelerate the development of home‑grown large language models that can run on infrastructure paid for in INR and accessed through UPI‑verified gateways. Second, enterprises must treat API keys as the crown jewels they are—store them in vaults, rotate them regularly and monitor every outbound request for signs of abuse. Until a robust ecosystem of Indic LLMs matures, reliance on external APIs will continue to expose Indian users to risks ranging from data leakage to indirect support of foreign military‑grade AI projects.

In the end, the best defence combines technical safeguards, sound policy and a clear national ambition to own the core technology that will shape the next decade of innovation.