Poison Claude: Fraudulent “Cheap AI” Service Intercepts Every Prompt Sent to Anthropic’s Claude
What Happened — Researchers at Okta uncovered “Poison Claude,” a black‑market service that sells discounted access to Anthropic’s Claude model by abusing AWS Bedrock free‑credit programs. Victims pay with cryptocurrency, receive a forged API key, and have their development tools pointed at Poison Claude’s servers, which relay queries to the real Claude and return the answer.
Why It Matters for Compliance & Audit Readiness
- The service acts as a man‑in‑the‑middle for AI prompts, creating a data‑exfiltration risk that directly challenges SOC 2 CC6 (Confidentiality) and privacy‑related controls.
- Continuous‑compliance programs must capture third‑party API usage and maintain an auditable trail of who accesses external AI models and what data is transmitted.
- Verisq’s CookiePLUS privacy capability helps map consent, data‑handling policies, and DSAR readiness to SOC 2 CC6, providing evidence that your organization controls what external AI services can see.
Who Is Affected
- Technology & SaaS firms that embed generative AI (e.g., software developers, fintech, health‑tech).
- Any organization that integrates Anthropic Claude or similar LLMs via cloud marketplaces.
Recommended Actions
- Inventory all AI model integrations and verify that API endpoints point to official provider endpoints.
- Enforce strict access‑control policies for API keys and require multi‑factor authentication for any credential provisioning.
- Incorporate AI‑prompt handling into your privacy impact assessments and document consent/DSAR processes.
Source: Fortra Blog – Beware cut‑price AI services that read your every word
Technical Notes
- Attack vector: exploitation of AWS Bedrock free‑credit program via fraudulent accounts; malicious proxy intercepts API traffic.
- No CVE is associated; the risk stems from third‑party service abuse and man‑in‑the‑middle interception of data.
- Data types at risk include proprietary code, business documents, API keys, and personally identifiable information.
Source: same as above