AI token gray market dodges US chip sanctions

Brokers in Beijing combine shell entities, bulk credentials, and steep discounts to supply local labs with frontier American AI.

An investigation published by tech outlet The Information revealed an expanding AI token gray market across China designed to deliver clandestine access to Anthropic’s Claude models. Known locally as “transfer stations” (zhongzhanjuan), brokers bypass geographic blocks through offshore proxy servers, accounts registered with illicit credentials, and shell corporations outside China. Their primary goal is model distillation, a training method where a frontier system provides synthetic data to teach smaller domestic models.

Inside the AI token gray market across Beijing

The business operates openly in the capital’s tech districts. In one office building within Beijing’s Haidian university hub, 6 out of 30 commercial tenants resell access to restricted US artificial intelligence models, according to reporting by The Information in October 2026. Market analysts estimate that thousands of similar brokers operate across China, though no official registry tracks them.

These intermediaries sell API connections and charge customers per token processed. Beyond evading geographic blocks, they undercut list prices, offering discounts between 50% and 90% compared to Anthropic’s official rates. A technical review by the Oxford China Policy Lab and German research center CISPA, reported by Tom’s Hardware, examined 17 of these services and confirmed that they act as anonymizing proxy layers, masking Chinese IP addresses and end-user credentials.

Disposable accounts and offshore shell firms

The underlying operational setup relies on simple workarounds. To register accounts at scale, brokers repurpose email lists gathered during earlier cryptocurrency projects. They fund opening balances with stolen credit cards or the dollar-pegged stablecoin USDT. When Anthropic spots the abnormal usage patterns and bans the accounts, automated scripts launch replacement batches on proxy servers in permitted jurisdictions.

Larger corporate labs require a different setup. Chinese groups register legal entities in business hubs like Singapore, the United Arab Emirates, and the United States. Operating behind these clean paper entities, they sign legitimate enterprise agreements directly with Anthropic or through Amazon Web Services (AWS). That maneuver circumvents Anthropic’s policy barring organizations where more than 50% of equity belongs to entities from restricted nations, as covered by The Chosun Ilbo.

The distillation shortcut around compute limits

Heavy interest in Claude comes down to engineering needs. The model is widely viewed as an industry benchmark for code generation and multi-step reasoning. Meanwhile, export curbs on high-end graphics processing units imposed by the US Department of Commerce have left Chinese developers without the hardware capacity needed to train frontier models from scratch.

Model distillation offers an alternative. Instead of running expensive pre-training workloads across thousands of GPUs, developers prompt Claude with complex programming tasks and feed its outputs into domestic models. The process transfers high-end capabilities while requiring a fraction of the compute resources.

Anthropic allegations and regulatory backlash in Beijing

The scale of this traffic was documented earlier by Anthropic itself. In a 154-page threat intelligence report released on September 10, 2026, Anthropic accused seven Chinese tech firms, including Alibaba, DeepSeek, and Moonshot AI, of running more than 24,000 deceptive accounts to harvest distillation data. Alibaba reportedly accumulated over 151 million requests between May and July, while DeepSeek generated 12.1 million queries within two weeks.

The illicit pipeline has also created friction at home. As reported by Yahoo News, the Cyberspace Administration of China (CAC) summoned the companies named in the report and launched investigations into DeepSeek and Moonshot AI. Regulators in Beijing are concerned that querying American servers may have leaked sensitive internal data, including police and public security records, without authorization.