More Than 80,000 Relay Servers Mask Chinese Access to U.S. Frontier AI Models

Team Cymru tracked over 80,000 relay servers that pool AI accounts and hide identities so users in China can bypass region bans on U.S. frontier LLMs, likely to clone the models via distillation.

Team Cymru researchers uncovered an ecosystem of more than 80,000 AI relay servers, described as 'transfer stations,' that pool AI service accounts and conceal user identities to help users in China bypass geographic restrictions on U.S. frontier large language models. The activity violates providers' terms of service, and the suspected aim is cloning frontier models through large-scale distillation. Most relays run open-source tools such as 'sub2api' and 'Claude Relay Service.' The findings corroborate a joint advisory from CISA, NSA, and FBI warning about large-scale Chinese AI distillation campaigns. The two reports agree on the 80,000+ server count and the distillation motive; no specific vendor, model name, or confirmed theft has been named.

• Team Cymru researchers identified more than 80,000 relay servers ('transfer stations') that pool AI service accounts and mask user identities.
• The relays let users in China bypass geographic restrictions on U.S. frontier large language models, circumventing providers' terms of service.
• The suspected motive is cloning frontier models through large-scale distillation.
• Most relays run open-source tools including 'sub2api' and 'Claude Relay Service'.
• The findings corroborate a joint CISA, NSA, and FBI advisory warning of large-scale Chinese AI distillation campaigns.
• No specific vendor, model name, or confirmed theft is named in either report.
• Report dates: Dark Reading, 2026-09-22; Help Net Security, 2026-09-23.