News · curated 5 Aug 2026
Free tokens for sale: How fake signups drive AI fraud | Threat Intelligence
First reported okta.com
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
Poison Claude and similar gray-market resellers show how fake signups and credit abuse fund illicit LLM access while silently exposing all customer prompts to a malicious middleman, a data-exposure and platform-fraud risk for AI providers and their users.
Okta Threat Intelligence documented a gray market of underground services, including one called "Poison Claude," selling discounted access to Anthropic LLMs (Opus and Sonnet models) by abusing fraudulently obtained free bonus credits such as the US$100 AWS Bedrock signup credit. Because customer requests are routed through the operator's pooled accounts, the operator can see every customer prompt, exposing user data to an untrusted intermediary.