80,000 relay servers help users in China slip past U.S. AI region bans
More than 80,000 relay servers are helping users in China bypass geographic restrictions on leading U.S. AI models, according to Team Cymru.
“What we have uncovered is an entire ecosystem designed explicitly to break the frontier model providers’ T&Cs, enabling fraud and illicit activity,” said Scott Fisher, Senior Principal Engineer at Team Cymru.
Earlier this month, CISA, the NSA and the FBI warned in a joint advisory that China-based AI firms are running large-scale knowledge distillation campaigns to pull capabilities out of leading U.S. models.
How the AI relay network operates
The relays, known as transfer stations, pool AI accounts and hand out their own keys to customers, so several people can reach frontier models through the same server. The provider sees only the relay, which hides who the users are and where they are, and makes it harder to enforce region bans, track usage and spot abuse.
How the transfer station system operates (Source:Team Cymru)
Fisher calls model distillation one of the most consequential forms of this abuse.
“Rather than independently creating the research, data, and compute required to build a frontier model, an actor can query a stronger ‘teacher’ model at scale, collect its outputs, and use them to improve a cheaper ‘student’ model. This allows portions of the teacher model’s capabilities to be transferred at a substantially lower cost than developing them independently, which is why major frontier-model providers prohibit using their outputs to train competing models.”
Most of the relays run Claude Relay Service or its successor, sub2api. Both tools are published on GitHub by a developer who goes by Wei-Shaw. The latest version includes user management, per-user billing, a layer that converts subscriptions into API access, and a prompt-audit feature.
The sub2api project has been forked more than 8,000 times, and its Telegram channel has close to 7,000 subscribers.
The sub2api GitHub page lists 26 commercial sponsors. Fifteen sell access to AI models through relays, seven sell residential proxies, and two sell accounts for AI services. The remaining two are a content delivery network built for relay traffic and a reseller of image and video generation.
According to Team Cymru, the account sellers obtain their credentials by exploiting promotional offers and possibly through credential or token theft.
Thousands of relays, terabytes of traffic
Over an eight-day window of scanning data, the researchers confirmed 10,867 relays, a number that later grew to more than 80,000. Of the first 10,867, 9,456 ran sub2api and 1,353 ran the older Claude Relay Service.
The relays were hosted on 457 different networks, and no single hosting provider accounted for more than about 11% of them.
The researchers examined one cluster hosted with a few VPS providers in the U.S. Over 4,000 addresses in China and Hong Kong connected to 304 relays in that cluster. Over eight days in late August, they uploaded about 14 TB and downloaded more than 7 TB.
Seventeen relays sent traffic straight to Anthropic’s API. They uploaded about 81 GB and downloaded about 1.4 GB, a ratio of 58 to 1.
The high volume of data sent to Anthropic’s API could be consistent with automated, large-scale querying. However, the researchers could not inspect the prompts or model responses and therefore could not confirm whether the activity involved model distillation or another form of abuse.
Team Cymru has shared the identified relay IP addresses with affected AI providers and says it will continue searching for new relays.
