Poison Claude Shadow AI: Detecting Unauthorized LLM Access and Data Exfiltration

In August 2026, cybersecurity researchers uncovered a disturbing trend in the underground economy: the commodification of unauthorized access to premium Large Language Models (LLMs). The "Poison Claude" service, actively advertised on cybercrime forums and messaging platforms, claims to provide discounted access to Anthropic’s advanced models—specifically branding fictitious or future versions like Opus 4.8, 4.7, 4.6, and Sonnet 4.6.

For defenders, this represents a critical evolution of Shadow AI risks. Employees or insiders seeking cost-effective access to high-end AI capabilities may inadvertently bypass corporate governance, integrating these unauthorized services into workflows. The operator of Poison Claude explicitly states they can view all customer prompts. This creates a direct channel for intellectual property (IP) theft, credential exposure, and confidential data leakage. We must treat this not just as a policy violation, but as an active data exfiltration channel.

Technical Analysis

Threat Vector: Poison Claude operates as a proxy or illicit reseller of API access. Users are typically provided with API keys or redirected web endpoints that interface with the threat actor's infrastructure before (potentially) reaching legitimate models or simply responding with simulated outputs.

Affected Platforms:

Target: Corporate environments where developers or data scientists utilize Python scripts, cURL, or browser-based tools to interact with LLMs.
Infrastructure: The threat relies on the victim initiating outbound connections to the threat actor's command-and-control (C2) or proxy infrastructure rather than official Anthropic endpoints (api.anthropic.com).

The Mechanism of Compromise: The attack chain is simple but devastating:

Procurement: An internal user obtains "discounted" API credentials or a URL for Poison Claude from an underground forum.
Integration: The user hardcodes these illicit credentials into a local script (e.g., a Python script using the anthropic library) or uses a customized web interface.
Exfiltration: When the script executes, it sends the prompt (which may contain source code, customer data, or proprietary secrets) to the Poison Claude operator.
Interception: The operator logs the prompt data in plain text before forwarding the request (or returning a generated response).

Exploitation Status: Confirmed active advertisements on underground forums. There is no CVE associated with this, as it is an abuse of service architecture and social engineering, not a software vulnerability. However, the technique leverages the lack of egress filtering and API usage monitoring within corporate networks.

Detection & Response

Detecting Shadow AI requires identifying deviations from approved baselines. Since Poison Claude claims to offer specific version numbers (Opus 4.8, etc.) that do not exist in the legitimate public Anthropic catalog (as of mid-2026), these strings serve as high-fidelity indicators in command-line arguments or configuration files.

Sigma Rules

YAML

---
title: Poison Claude Unauthorized API Usage
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects process execution attempting to connect to LLM services using specific version strings associated with the Poison Claude underground service (Opus 4.8, 4.7, 4.6).
references:
 - https://thehackernews.com/2026/08/poison-claude-sells-discounted-claude.html
author: Security Arsenal
date: 2026/08/15
tags:
 - attack.exfiltration
 - attack.credential_access
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   CommandLine|contains:
     - 'anthropic'
     - 'claude'
   CommandLine|contains:
     - 'opus-4.8'
     - 'opus-4.7'
     - 'opus-4.6'
     - 'sonnet-4.6'
 condition: selection
falsepositives:
 - Legitimate testing of new API versions by developers (unlikely for these specific versions)
level: critical
---
title: Unauthorized Python LLM Library Usage
id: 9b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects execution of Python scripts interacting with Anthropic libraries from non-standard directories or user profiles, indicative of Shadow AI setup.
references:
 - https://thehackernews.com/2026/08/poison-claude-sells-discounted-claude.html
author: Security Arsenal
date: 2026/08/15
tags:
 - attack.execution
 - attack.t1059.001
logsource:
 category: process_creation
 product: windows
detection:
 selection_img:
   Image|endswith: '\python.exe'
 selection_cli:
   CommandLine|contains:
     - 'import anthropic'
     - 'ANTHROPIC_API_KEY'
 filter_legit:
   Image|startswith:
     - 'C:\Program Files\'
     - 'C:\Python\'
   ParentImage|endswith:
     - '\code.exe'
     - '\idea64.exe'
 condition: selection_img and selection_cli and not filter_legit
falsepositives:
 - Developer using virtual environments in non-standard paths
level: high

KQL (Microsoft Sentinel)

This query hunts for network connections initiated by script engines (Python, Node, cURL) to domains containing "anthropic" or "claude", excluding known legitimate IP ranges if they are whitelisted.

KQL — Microsoft Sentinel / Defender

DeviceNetworkEvents
| where Timestamp > ago(7d)
| where ActionType == "ConnectionSuccess"
| where RemoteUrl has_any ("anthropic", "claude") or RequestUrl has_any ("anthropic", "claude")
| where InitiatingProcessFileName in~ ("python.exe", "python3.exe", "node.exe", "curl.exe", "pwsh.exe", "powershell.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP
| extend TaintedKey = iif(InitiatingProcessCommandLine contains "opus-4.8" or InitiatingProcessCommandLine contains "opus-4.7", "PoisonClaudeIndicator", "SuspiciousAIUsage")
| order by Timestamp desc

Velociraptor VQL

Hunt for the presence of hardcoded API keys or specific version strings in configuration files and scripts on the endpoint.

VQL — Velociraptor

-- Hunt for Poison Claude indicators in script files
SELECT FullPath, Size, Mtime
FROM glob(globs="*/Users/*/*.py")
WHERE 
   read_file(filename=FullPath) =~ "opus-4.8" 
   OR read_file(filename=FullPath) =~ "opus-4.7" 
   OR read_file(filename=FullPath) =~ "poison.*claude"
-- Add Linux/macOS paths if relevant
-- UNION ALL SELECT FullPath, Size, Mtime FROM glob(globs="/home/*/*.py") WHERE ...

Remediation Script (PowerShell)

Use this script to audit Windows endpoints for environment variables or recent files containing the specific malicious version strings associated with Poison Claude.

PowerShell

<#
.SYNOPSIS
    Audit for Poison Clair Shadow AI indicators.
.DESCRIPTION
    Scans user profiles for hardcoded illicit API keys or specific version strings.
#>

$Keywords = @("opus-4.8", "opus-4.7", "sonnet-4.6", "poison-claude")
$SuspiciousFiles = @()

# Scan user profiles for Python scripts and config files
$UserProfiles = Get-ChildItem "C:\Users" -Directory -Exclude "Public", "Default*"

foreach ($Profile in $UserProfiles) {
    $SearchPath = $Profile.FullName
    
    # Check for environment variables (common way to store API keys)
    $EnvVars = Get-ChildItem Env:\
    foreach ($Var in $EnvVars) {
        if ($Var.Value -match "opus-4") {
            Write-Warning "Suspicious Env Var found in $($Profile.Name): $($Var.Name)"
        }
    }

    # Search recent files in common project directories
    $Targets = Get-ChildItem -Path $SearchPath -Include (*.py, *., *.txt, *.sh, *.ps1) -Recurse -ErrorAction SilentlyContinue | 
                Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) }

    foreach ($File in $Targets) {
        $Content = Get-Content $File.FullName -Raw -ErrorAction SilentlyContinue
        if ($Content) {
            foreach ($Keyword in $Keywords) {
                if ($Content -match $Keyword) {
                    $SuspiciousFiles += [PSCustomObject]@{
                        User = $Profile.Name
                        Path = $File.FullName
                        Match = $Keyword
                    }
                    break # Found one keyword, move to next file
                }
            }
        }
    }
}

if ($SuspiciousFiles.Count -gt 0) {
    Write-Output "Poison Claude Indicators Found:"
    $SuspiciousFiles | Format-Table -AutoSize
} else {
    Write-Output "No immediate Poison Claude indicators found."
}

Remediation

Immediate action is required to plug this data leakage channel:

Network Segmentation & Egress Filtering:
- Block direct internet access to AI API endpoints from user workstations. Force all LLM traffic through a secure corporate API gateway.
- Identify and block IP addresses associated with Poison Claude advertisements (Threat Intel should be consulted for current IOCs).
DLP Implementation:
- Configure Data Loss Prevention (DLP) policies to inspect HTTPs payloads (where SSL inspection is enabled) for high-volume data transmission to non-whitelisted domains.
- Flag any prompt data containing source code, PII, or confidential keywords leaving the network.
Policy Enforcement:
- Re-issue the Acceptable Use Policy (AUP) explicitly banning the use of "discounted," "cracked," or third-party AI resellers.
- Require official API keys to be stored in a centralized secret manager (e.g., HashiCorp Vault, Azure Key Vault), not in local .env files or scripts.
User Awareness:
- Alert development and data science teams about the specific Poison Claude campaign. Emphasize that "free" or "discounted" Opus 4.8 access is a social engineering trap designed to steal data.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub