Team Cymru maps more than 80,000 relay nodes hiding who actually calls AI APIs

What Team Cymru found

Security researchers at Team Cymru have documented a sprawling ecosystem of relay gateways sitting between users and major AI services, according to a summary of their report "Relaying to the Frontier", published 22 September 2026 and surfaced via dev.to. Built around open-source tools such as Claude Relay Service (CRS) and sub2api, these gateways maintain pools of subscription accounts, API keys, OAuth tokens and session tokens, then route user requests to AI providers through intermediate servers in other countries.

An initial eight-day scan confirmed 10,867 relay nodes running CRS or sub2api. When the researchers widened the scan to include a broader set of gateway and relay software signatures, the count climbed past 80,000 nodes.

How the relays work

The mechanism, as Team Cymru describes it, is simple. A user, observed primarily in China and Hong Kong, sends a request to a gateway. The gateway picks credentials from its pool and forwards the request to a relay, often hosted in the United States. That relay connects to services such as OpenAI, Anthropic, Google and xAI using valid credentials, and the response travels back along the same path.

From the provider's perspective, the request appears to originate from the relay's IP address and a shared account rather than the actual person making it. Regional access rules, per-user attribution and rate limits all become difficult to enforce.

The observed scale

In one US relay cluster, roughly 4,000 IP addresses in China and Hong Kong sent about 14 TB of data to 304 relay nodes over eight days and received more than 7 TB in return. Team Cymru cautions that these totals measure traffic reaching the relays, not traffic delivered directly to the AI companies.

What is and is not confirmed

The report is careful about its own limits. Bidirectional traffic between relay nodes and AI services was confirmed, meaning working access through this infrastructure is real. But Team Cymru could not inspect prompt contents, could not determine how the pooled credentials were obtained, and did not verify speculation that the traffic supports model distillation or extraction. Credentials may arrive via voluntary sharing, resale, promotional abuse or theft; the exact mix is unknown, and the researchers warn against describing all of them as stolen.

Detection and defenses

For administrators, the report lists indicators worth monitoring: one account or API key authenticating from many IP addresses and autonomous systems, geographically implausible access patterns, abrupt jumps in token consumption, and a single relay touching multiple accounts. Legitimate credential owners may notice the problem first through unexpected billing, unfamiliar usage history or sudden rate limiting.

Suggested countermeasures include assigning separate, short-lived credentials to each user or use case, rotating them regularly and revoking them promptly; flagging or blocking credentials seen across many networks; and setting policy that bars staff from entering corporate credentials into unauthorized gateways. Endpoint checks should look for AI keys stored in browsers, CLI tools, extensions and configuration files, while network teams can watch for connections to known relay infrastructure.

Dark Reading, cited as a related source, frames the same finding as a broader erosion of AI safety controls.

Why it matters

The sheer scale, tens of thousands of nodes, shows this is not a fringe workaround but an established infrastructure layer between users and frontier models. For AI providers, it means regional restrictions and usage policies can be quietly sidestepped, because what they observe is a relay address rather than the person behind the request. For organizations, any credential that passes through one of these gateways lands in a shared pool whose use the owner cannot control, translating into quota loss, surprise charges and possible suspension. And for anyone trying to understand how frontier models are actually being used, the setup breaks attribution entirely: enormous volumes of prompts and completions flow through intermediaries whose operators, motives and beneficiaries cannot be identified from the outside. Team Cymru's own caution cuts both ways, since mass data harvesting can be neither confirmed nor ruled out.