# Anthropic's September Threat Report: a "Cheap Claude" Reseller That Was Neither Cheap Nor Claude, LiteLLM Key Theft and Alleged Industrial Distillation

Anthropic's September 2026 threat report documents a reseller that sold discounted Claude access, silently proxied buyers to a different model and harvested their Anthropic credentials. It also describes prompt-injection attacks on wrapper services' LiteLLM implementations and alleged distillation that TechCrunch puts at nearly 200 million exchanges, 151 million attributed to Alibaba.

By Neomanex. Updated 2026-09-26.

If someone is selling you Claude at a discount, assume you are not getting Claude. Anthropic's September 2026 threat report documents exactly that case, and the buyers lost their Anthropic accounts as well as their money. It also shows attackers pulling production API keys out of wrapper services built on [LiteLLM](/directory/litellm). None of this changes a directory rating: LiteLLM stays **Conditional**, and the report names no flaw in LiteLLM itself. What it changes is how you should buy Claude access and guard AI keys.

## What happened

### The fake reseller

Anthropic tracks the group as GTG-50021, a "Russian and Ukrainian speaking group, one of whom went by the alias 'kl1zy.'" It "ran a fraudulent AI reseller operation offering cheap Claude access", which "turned out to be neither cheap nor actually Claude." In Anthropic's account:

- **What buyers got.** Their traffic "was in fact silently proxied to a different AI model".
- **What they lost.** The reseller's tooling "installed a credential harvester, stealing their Anthropic account credentials and selling them onward to other AI proxy resellers for malicious use."
- **Indicators.** The report lists the operation's domains, including awstore[.]cloud, kiro[.]cheap, sys-tools[.]cfd, aws-us-east-3[.]com, holdboost[.]store and deltaclient[.]xyz.

### The LiteLLM wrappers

The report also covers the AI supply chain: "multiple actors were observed compromising AI wrapper services' implementation of LiteLLM", using "prompt injection to exfiltrate the production API keys used in their cloud-hosted container environments." The report places the compromise in the wrapper services' implementations, not in a LiteLLM vulnerability. Anthropic's guidance: "Organizations should treat AI keys and agent integrations with the same level of seriousness as they do production credentials, because attackers treat them with the same level of seriousness, too."

### The distillation allegations

The report also covers illicit distillation, where a lab mass-queries another lab's model to train its own. TechCrunch's reading of the report gives the scale:

| Campaign | Volume | Window | Accounts |
|---|---|---|---|
| All five campaigns | Nearly 200 million exchanges | Not stated | Not stated |
| Alibaba | 151 million exchanges, peaking near 3 million a day | May to July 2026 | About 3,500 |
| Moonshot AI | Nearly 300,000 requests, mainly targeting Opus | 10 days | About 5,000 |

These are Anthropic's attributions. TechCrunch carried no responses from the companies named, and nothing here has been verified outside Anthropic.

## Why it matters

Every Claude access path that does not run through Anthropic, a major cloud or a provider you can verify is now a documented fraud and credential-theft risk. A discount reseller can swap the model without telling you, so any quality or safety assumption you made about Claude does not hold. And a gateway that holds your provider keys is a target in its own right: prompt injection turned wrapper services into key-exfiltration points.

## What changes for you

- **Buying Claude.** Go direct to Anthropic, a major cloud marketplace, or a provider you can verify. Treat discount resellers as untrusted.
- **If you used a reseller.** Rotate your Anthropic account credentials and check your logs for the domains Anthropic lists.
- **Running LiteLLM or another gateway.** Store and rotate the provider keys it holds with production-credential controls, and treat any model-facing input as able to reach those keys.

## FAQ

**Is LiteLLM itself compromised?**
The report describes attacks on wrapper services' implementations of LiteLLM and names no LiteLLM vulnerability. Our LiteLLM verdict stays Conditional.

**How would I know a reseller swapped the model?**
You may not. Anthropic says the traffic was "silently proxied to a different AI model", which is why buying from a verifiable source is the only reliable control.

**Did Alibaba or Moonshot AI respond?**
Not in the coverage we cite. The figures are Anthropic's attributions as reported by TechCrunch.

Canonical: https://neomanex.com/news/anthropic-september-threat-report-fake-claude-resellers-distillation