Massive Chinese Relay Network Exposed Circumventing US AI Model Controls
In September 2026, Team Cymru researchers discovered a vast network of over 80,000 AI relay servers enabling Chinese users to access frontier AI models from US companies including OpenAI, Anthropic, Google, and xAI while masking their identities and locations. The relay infrastructure allows systematic circumvention of geographic restrictions and terms of service, with evidence suggesting large-scale model distillation attempts. Over an eight-day period, Chinese IP addresses transmitted 14TB of data through relay stations, with particularly suspicious traffic to Anthropic showing a 58:1 upload-to-download ratio consistent with AI model cloning operations. This campaign leverages open-source software packages like Claude Relay Service and sub2api, distributed through GitHub and Telegram channels with thousands of subscribers, pointing to widespread adoption of these circumvention techniques. This incident highlights the growing sophistication of AI intellectual property theft operations and the urgent need for enhanced detection capabilities as nation-state actors increasingly target frontier AI models for competitive advantage.
Kill Chain
