Stolen Keys, Fake Matches, and 151 Million Conversations

To understand the technical words and acronyms used in this series, please refer to this: A Primer on Terminology

The deal here is not in capability, which is cheap, but in using it unwatched. This is the part India's AI policy has not caught up with.

This final article is about money and theft. Access to a good AI model has become something worth stealing, much as stolen credit cards are worth stealing, and an entire supply chain has grown up around moving it. At the top of that chain sit seven Chinese technology companies, some of them household names, which were caught copying the reasoning of an American model at industrial volume. Three were also caught quietly passing their own paying customers’ work to the American company without telling anyone.

The last three sections of the report describe a single economy with four layers. Criminals steal access to AI models from companies that pay for it legitimately. That stolen access funds further criminal operations and is also sold to fraudulent resellers. Those resellers supply laboratories and researchers who are barred from buying the models directly. At the far end, unauthorised laboratories use whatever access they can obtain to copy the capability itself. Every layer depends on the one below it.

Layer one: AI access as loot, compute and cover

Access to models, in the form of compromised API keys, session tokens and devices, has become the sole objective of multiple criminal groups. Stolen keys are worth three distinct things at once: resale value, compute for running attack workloads at the victim's expense, and cover, because the activity is attributed to the legitimate key owner.

Across the intrusion cases in Part One, operators stole AI keys from victim environments and immediately switched to using them instead of their own. In every documented instance the keys were stolen from customers' environments. Anthropic states that its own systems were not compromised at any point in these operations.

The harvesting methods are industrial: racing patches for mass exploitation, rummaging through public container stores, code repositories, mobile applications and websites, mass scanning of internet-facing devices, creating accounts on low-security service providers to escape their containers, and hiding instructions inside material a model was about to read, a technique called prompt injection, in order to make it hand over the access keys held in a company’s cloud systems.

GTG-50021 illustrates the reseller end of that economy in operation. A Russian and Ukrainian-speaking group, one using the alias kl1zy, ran a fraudulent reseller operation offering cheap Claude access that was neither cheap nor Claude. Customer traffic was silently proxied to a different model while the reseller's tooling installed a credential harvester that stole their Anthropic account credentials and sold them on to other proxy resellers.

A related operation stood up websites posing as intermediary services offering discounted access to frontier models. Visitors were induced to install client applications spoofing popular AI tools, which were credential harvesters collecting everything on the device. Because a victim's key might be identified and reset, the harvester stayed resident and kept sending each new session to the attacker.

GTG-50020 illustrates how far the ambition in this market now runs. A Russian-speaking financially motivated actor who had historically hit hotel booking and financial technology platforms, exfiltrating roughly 26 gigabytes from one victim and seeking $1.5 to 2.5 million in extortion. They then pointed the same tradecraft at the AI industry.

By injecting malicious instructions into an AI vendor's automated evaluation sandbox, they caused it to hand over the credentials it held, including production API keys from multiple providers. They used those stolen keys to continue attacking the vendor and unrelated targets simultaneously. A follow-on campaign from the same infrastructure attacked roughly thirty AI companies in about four days, finding one working attack path and repeating it against all thirty with minor adaptations.

Their stated goal, pursued across more than a dozen avenues, was access to a pre-release Claude model. Every one of those attempted paths failed, and the actor never gained the access they were seeking.

The same actor also ran a fraud account factory, provisioning residential proxies and antidetect browser profiles while bots drove signup flows on exchange and marketplace targets, defeating onboarding controls with commercial CAPTCHA-solving services and automated identity verification. And a phishing technique the report calls a KYC interception cloak: victims were sent to lookalike verification domains whose reverse proxy relayed the real identity-verification flow, so the victim completed genuine verification while the operator captured the verified session and documents in the middle.

The report's verdict on this case is that it is the clearest demonstration to date that the AI supply chain has become a deliberate criminal target.



Layer two: fraud at conversational scale

A China-based app studio built a network of more than twenty dating apps and used the model to power the personas that talked to users, while advertising the service as fully human. Over a two-week window in April 2026, Anthropic found more than 4,700 distinct AI personas in conversation with at least 25,000 unique individuals, running roughly 2.36 million messages.

The architecture underneath the operation worked as a three-sided marketplace.

The targeted user, primarily in the US, swiped a feed that was about 75 per cent AI personas and 25 per cent real people, with no way to tell them apart. Messaging and matching drew down a metered quota refilled by buying in-app coins.

The real people were gig workers recruited by invitation, mixed into the same feed at roughly one to every three AI personas. They existed to handle what the model could not do: live video calls and social media follow-backs, the authenticity checks that reduce a victim's scepticism. The gig workers were themselves AI-augmented, because a smaller model from another provider proposed three candidate replies and the worker tapped one, which pre-empted any concurrent automated reply. They were paid per message, per video call and per follow-back.

The personas ran autonomously, instructed never to disclose they were automated, to deflect requests for video calls or photos, and to move through a fixed sequence of conversational stages. Backend components fabricated likes, visitors and pre-recorded video when no real person was available, and tracked which users had begun to suspect they were talking to a bot.

The applications themselves were engineered specifically to defeat app store review. Developer documentation showed a user-interface controller that activated only during store review and was otherwise dormant. Class names were differentiated across more than twenty app variants to defeat the similarity checks platforms use to link related apps. An in-app browser redirecting payments to third-party processors was configurable server-side so it could be hidden during review.

Two findings from this case belong in any serious conversation about AI companionship products. The system prompt reads as an ordinary roleplay or companion deployment. The monetisation and the deception were not visible from inside any individual exchange. And in a small number of sampled cases the model's own reasoning surfaced the harm, including exchanges where users disclosed serious illness or acute distress, and the output continued in persona anyway.

India runs one of the world's largest online dating markets and has a documented epidemic of digitally mediated financial fraud. This case describes the operational template, and the report notes it drew on multiple AI providers for distinct non-overlapping roles, with findings shared with the others.

Layer three: the reasoning heist

Since February 2026, Anthropic has identified and disrupted distillation campaigns from seven China-based laboratories. None targeted its restricted top-tier models, which are not publicly available. All of these campaigns targeted the generally available models instead.

Distillation is a legitimate and ordinary training method, under which a large capable model is asked a great many questions, and its answers are then used to teach a smaller model to imitate it, in the way a trainee learns by watching an expert work. What the report describes is industrial-scale covert extraction enabled by fraud: networks of fake accounts created with stolen cards, stolen credentials and stolen API keys, accessed through proxy services that create thousands of accounts with false identities to defeat geographic restrictions.

The extraction techniques escalated steadily as the defences against them improved. Early attempts were crude, including prompts that simply instructed the model not to flag the request as reasoning extraction, or that claimed a debugging session in which outputting prior reasoning verbatim was expected and safe, while the later attempts were considerably more sophisticated. One laboratory ran a test experiment of more than twelve thousand requests, each using a different technique, to find out which would work, then built a larger campaign on the successful ones. Another extracted traces by directing the model to translate its previous working memory into other languages.

Xiaomi's timing in this campaign deserves separate attention from the rest of the table. Anthropic suggests it may have launched a model with a free trial period, later extended, specifically to use the resulting surge in international developer traffic as distillation material. The bulk of the attacks began just as the trial was ending.

What leaked in the other direction

Because three laboratories routed their own customers’ traffic through Claude, Anthropic could see what those customers sent. That reverse leak is one of the most striking disclosures in the entire report.

A user assessed as likely affiliated with the People's Liberation Army loaded CCTV archive data on a single tracked individual, drawn from hundreds of cameras in Chengdu including cameras outside PLA facilities, institutes affiliated with a major state electronics corporation, and a large state-owned enterprise, and asked for analysis of whether the person was behaving abnormally.

An engineer at a major Chinese state-owned enterprise building an internal system exposed internal code and live credentials from multiple major Chinese technology companies.

An employee of a Chinese technology company analysing internal documentation exposed the full specifications, organisational structure and strategic objectives of a flagship AI programme.

An IT operator working with data from a Russian government agency associated with its Ministry of Defence exposed live credentials for a Russian government database.

Engineers building a case management system for a municipal Public Security Bureau in China exposed a tool comparing a person's movements against police records using citizens' national identity numbers.

None of the users involved had any way of knowing, and Anthropic says it does not know whether the laboratories notified their customers afterwards. The relayed traffic contained names, contact information, corporate data and other sensitive material from hundreds of end users in at least a dozen languages, much of it arriving through third-party model routing services commonly used by developers in the United States and Europe.

Indian developers use those same third-party routing services, and they use them heavily.

The two findings India's AI policy has to absorb

Safeguards do not survive distillation

Anthropic states, from its own research, that a copied model can help somebody achieve dangerous things in biology and in computer attack even when none of the copied conversations touched on either subject, because what gets copied is the general ability to reason, and that ability then applies everywhere. General reasoning ability drives performance on nearly every task, so capturing it transfers capability across domains that were never targeted. The protections that prevent misuse of the teacher do not transfer to the student.

Procurement under the national AI mission, model choices for Indian-language infrastructure, and the widespread practice of fine-tuning open-weight Chinese model families for domestic applications all currently treat a base model's safety properties as inherited. This report establishes that they are not inherited at all.

Adversaries now comparison-shop safeguards

Preparing a campaign to target the cyber capabilities of leading US models, Zhipu first went after Anthropic's most capable generally accessible model. It abandoned the attempt after strengthened cyber safeguards degraded the attacks. Its researchers then switched to an older Opus model and to the leading model of another US laboratory, in Anthropic's account, expressly because they assessed those safeguards as weaker.

There is now a functioning market in safety differentials, which means that unilateral safeguards redirect aggregate risk while doing very little to reduce it. Any national framework built on the premise that raising one provider's standard raises the floor is working from an assumption this report falsifies.

India has not yet decided whether it wants to join trusted-access arrangements, build its own parallel system, or route around both. That decision is being made implicitly through procurement defaults and developer convenience. It should be made explicitly through policy.