What is an AI API proxy, and why is it risky? A gray-market AI API proxy relays your requests to a model provider through accounts and keys it controls, not yours, and sells that access at a fraction of the provider's price. The CISA, NSA and FBI advisory AA26-251A calls this market "transfer stations" and says it is used to bypass regional restrictions, breach terms of use, evade safeguards and undermine traceability1. Anthropic says the accounts behind it are often created with false identities and stolen cards, or are stolen API keys of legitimate companies2. A buyer sends data to an operator nobody can vouch for; a key holder may find their own key in the pool.
This guide covers what transfer stations are, where their capacity comes from, the risks on both sides, and a test that separates a legitimate gateway from a proxy pool without relying on brand names.
What a transfer station is
The advisory describes a gray market of API proxies, outside the providers' control, that companies use to reach US frontier models from regions where they are not offered, and says these proxies resell access at a fraction of the official price1. Anthropic uses the same name for the proxy services that labs route distillation traffic through2, and OpenAI's February memo describes networks of unauthorized resellers of its services used to evade its platform controls, and obfuscated third-party routers that mask where traffic comes from3.
The Decoder, drawing on research by Zilan Qian and a CISPA study, described the mechanics as reported in August 2026: proxies hosted outside China accept requests, forward them as if from a permitted location, return the responses, and take payment through local payment apps, with account brokers registering accounts in bulk4. Researchers studying the same kind of service outside that market call them "shadow APIs"5.
What makes something a transfer station is not that it sits between you and the provider. Many legitimate services do. It is that the provider has not authorized the accounts it uses to serve you, and you cannot find out whose they are.
Where the capacity comes from
Selling access at a fraction of the provider's price only works if someone else is paying the provider, or nobody is. The public accounts describe several sources:
- Fraudulent accounts. Proxy services create thousands of accounts with false identities and fake or stolen cards2; Anthropic described one network managing more than 20,000 accounts at once6.
- Stolen API keys. Anthropic says these services often use stolen API credentials belonging to legitimate companies or individuals, and describes brokers feeding compromised keys and session tokens into fraudulent reseller networks that rotate in new ones until each is exhausted2.
- Shared and bulk-bought subscriptions. The advisory describes premium subscriptions bought in bulk and shared across teams1.
- Regional and verification workarounds. The Decoder reports SMS platforms supplying foreign phone numbers and identity checks beaten with fake documents, and says some accounts may be funded with stolen cards, a share it could not measure4.
Stolen API keys and distillation campaigns covers the key side of that supply.
Risks for buyers
| Risk | What the sources describe |
|---|---|
| Your data goes to an unknown operator | The proxy operator can see prompts, responses and tool calls; The Decoder found no proof that the data is sold on, and no assurance that it is not4 |
| Your traffic is mixed with extraction traffic | Anthropic says proxy networks mixed distillation traffic with unrelated customer requests6, and that some labs silently relayed their own customers' requests to Claude2 |
| You may not get the model you pay for | An audit of shadow APIs found fingerprint identity checks failing in 45.83% of tests and output divergence of up to 47.21% on the endpoints audited5 |
| Access can vanish overnight | Anthropic bans suspected accounts often within two hours of a campaign starting7; 4 of the 17 shadow APIs studied had stopped operating by the time the paper was written5 |
| Malware dressed as an AI service | Anthropic describes sites posing as multi-model AI intermediaries that pushed credential-harvesting clients spoofing tools such as Claude Code, and a group selling Claude access that served a different model while installing a harvester2 |
| No contract with the provider | Proxies breach the provider's terms by design1; you have no data processing agreement, no support and no recourse with the provider |
Anthropic's own conclusion in its September report is blunt: AI access should be purchased only through authorized channels, and an offer that requires routing traffic and credentials through an unknown intermediary introduces serious risk to user data and systems2.
There is a compliance angle as well. If your prompts contain customer data, sending them to an operator with no agreement, no named subprocessors and no known jurisdiction is a disclosure your privacy terms almost certainly do not allow. If your requests ride on a stolen key, you are also paying for someone else's loss.
Risks for key holders
The other side of the market is the company whose key is in the pool. Anthropic describes operators scanning public containers for exposed keys and rotating the valid ones through a proxy layer so their traffic blends with the legitimate owner's2. A key in a pool is drained until it stops working: the owner pays the bill, and the provider's abuse controls act on the owner's account. The defences are the usual ones, applied seriously: one key per workload, provider spend limits, usage read by key, and fast revocation. Signs an AI API key is being abused lists what to look for.
How to tell a legitimate gateway from a proxy pool
Gateways, routers and aggregators are a normal part of AI infrastructure, and many are legitimate: some run requests on your own provider accounts, others on their own accounts under agreements with the providers. Neither model is the problem. The problem is unauthorized capacity and hidden identity. These questions separate the two without needing to judge any company by name.
| Question | Legitimate gateway | Proxy pool |
|---|---|---|
| Whose provider account serves the request? | Yours, or the gateway's own account under a disclosed agreement with the provider | Undisclosed accounts, often many, rotating |
| Is the provider named for each request? | Yes, in responses, logs or the request detail | No, or only a model name |
| Can you see the traffic in a provider console? | With your own accounts, yes | Never |
| How is access priced? | Provider rates, or published prices with terms you can read | A fraction of the provider's price with no explanation |
| Who operates it, and where? | A named company with terms, a privacy policy and subprocessors | Anonymous or unverifiable |
| How do you pay? | Invoice or card to a named company | Payment channels chosen to avoid identification |
| What happens if the provider bans an account? | Nothing; the accounts are authorized | Access breaks or silently changes model |
The strongest version of the first answer is bring your own key: requests run on provider accounts you own, the provider bills you directly, and you can check every request against the provider's own usage report. What BYOK means in AI explains the arrangement and the questions to ask any platform that offers it, and AI vendor security review questions covers the rest of a review.
- Ask every intermediary which provider accounts serve your requests, and get the answer in writing.
- Check that the provider is named for each request and that the model identity matches.
- Prefer arrangements where you can see the same traffic in your own provider console.
- Refuse any offer whose price cannot be explained by the provider's published rates or a disclosed agreement.
- Never install a client from an AI access seller; use the provider's or a well-known open-source SDK.
How INFRO handles provider access
INFRO is a gateway of the first kind and runs only on provider accounts its customers connect. It holds no provider accounts of its own and charges a software subscription with 0% markup on model spend; your provider bills you directly under your own contract. The provider is named on every request, failover moves only between your own connections, and the same traffic appears in your provider's console and usage reports. On the Business plan, reconciliation compares INFRO's estimates with OpenAI's and Anthropic's own cost reports daily and, with usage access on, shows traffic on your account that did not go through INFRO.
Because INFRO stores the provider keys you connect, it is also one of the places a key could be stolen from. Keys are encrypted with AES-256-GCM under a key held outside the database, bound to the organization and connection, and never shown again after saving. Even so, INFRO's budgets, allowlists and IP restrictions govern only traffic that goes through INFRO; a provider key stolen from anywhere, INFRO included, can be used directly against the provider. The backstops are provider-side: scoped keys, provider spend limits, revocation and the provider's usage reports.
Summary
A transfer station sells access to someone else's provider accounts, and the 2026 record says many of those accounts are fraudulent or stolen. Buyers get an anonymous operator reading their data, a model that may not be the one advertised and access that can disappear overnight; key holders get the bill. Use providers or intermediaries that name the provider, run on accounts that are yours or authorized, and let you verify the traffic yourself.