Team Cymru Finds 80,000 Relay Servers Masking Chinese Access to US AI Models

September 23, 2026 at 02:12 AM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Team Cymru identified more than 80,000 LLM relay servers that route Chinese users to frontier AI models from Anthropic, OpenAI, Google, and xAI. The relays obscure user identity and location, undermining provider controls against misuse. The finding follows US accusations that Chinese AI firms are cloning US capabilities through distillation.

Key Facts

Team Cymru identified more than 80,000 LLM relay servers acting as intermediaries between users and AI providers.
Over an eight-day period, more than 4,000 IP addresses in China and Hong Kong sent about 14TB of data to relay stations and received over 7TB in return.
Users uploaded about 81GB of data to Anthropic via 17 relay servers and downloaded approximately 1.4GB in responses over the same period.
The relay servers allow operators to pool credentials for multiple AI accounts and route requests to Anthropic, OpenAI, Google, and xAI.

Relay Network Scale

Team Cymru initially identified 10,867 transfer stations across 457 autonomous systems, then updated the count to more than 80,000 relays after further investigation. The company examined a cluster of relay servers hosted by several US virtual private server providers and found more than 4,000 IP addresses in China and Hong Kong connecting to them. Over an eight-day period, those addresses sent about 14TB of data to the relay stations and received more than 7TB in return. Some of the same relays connected to both Chinese AI providers and Western companies, including Anthropic, OpenAI, Google, and xAI.

Control Evasion

Team Cymru researcher Scott Fisher wrote that relay servers can undermine the controls frontier AI providers rely on to detect and restrict misuse. By separating the apparent requester from the actual user, relay servers help obscure who is accessing models and enable users to bypass potential geographic restrictions. They also allow users to share or resell credentials and to evade a provider's terms of service. Fisher stated that a transfer station breaks the assumption every frontier-model control depends on: that the account making a request belongs to the party consuming the answer.

Anthropic Traffic

According to Team Cymru, the traffic observed going directly to an Anthropic API was especially noteworthy for its sheer volume. Over the eight-day period, users uploaded some 81GB of data to Anthropic via just 17 relay servers and downloaded about 1.4GB in responses. The findings come days after the US government accused Chinese AI companies of attempting to clone US AI capabilities via systematic distillation campaigns.