LLM relay servers identified by Team Cymru: 80,000+ (Source: Team Cymru, as reported by Dark Reading (September 27, 2026))
What Team Cymru found
Team Cymru researchers have identified more than 80,000 LLM relay servers that sit between users and frontier AI providers, according to Dark Reading's coverage of the company's report. The relays let operators pool credentials for multiple AI accounts and route user requests to services including Anthropic, OpenAI, Google and xAI. The provider then sees the relay's IP address and upstream credentials, not the end user's IP address or direct identity.
Team Cymru first counted 10,867 transfer stations across 457 autonomous systems. After further analysis it revised the figure to more than 80,000.
Why it matters to an organisation
Team Cymru researcher Scott Fisher framed the issue as an assumption that fails. "A transfer station breaks the assumption every frontier-model control depends on: that the account making a request belongs to the party consuming the answer," he wrote. Account attribution, usage metering, rate limits, abuse detection, regional availability and contractual terms are all enforced against whoever holds the credentials.
The report says relays can obscure who is accessing a model, help users bypass geographic restrictions, allow credentials to be shared or resold, and let users evade a provider's terms of service. For an organisation that buys, resells or embeds AI access, the question is whether its own controls depend on that same assumption.
The traffic pattern
Team Cymru examined a cluster of relays hosted by several US virtual private server providers. Over an eight-day period, more than 4,000 IP addresses in China and Hong Kong sent about 14TB of data to the relay stations and received more than 7TB in return. Some of the same relays connected to both Chinese AI providers and Western companies.
Traffic going directly to an Anthropic API stood out for its volume. Over the same eight days, users uploaded some 81GB through just 17 relay servers and downloaded about 1.4GB in responses. Team Cymru interpreted the 58:1 upload-to-download ratio as potentially consistent with large-scale distillation, where a frontier model's outputs are used as training data for a cheaper, less capable model. That is an interpretation of traffic volumes, not a confirmed finding of cloning. The report appeared days after the US government accused Chinese AI companies of attempting to clone US AI capabilities through systematic distillation campaigns.
The tooling behind the relays
Team Cymru identified two open source packages, Claude Relay Service (CRS 1.x) and its successor sub2api, both published on GitHub by developer Wei-Shaw. The newer sub2api supports user management, per-user billing, subscription-to-API conversion and prompt auditing. Users had forked it more than 8,000 times, and its Telegram channel had nearly 7,000 subscribers. Team Cymru notes those figures show interest in the software but do not establish how many people use it for malicious purposes.
Sub2api's GitHub page lists 26 commercial sponsors. Team Cymru found that 15 sold access to models such as Claude and OpenAI, seven provided IP addresses, two supplied accounts for accessing AI services, and one each provided traffic-optimised infrastructure and image and video generation services.
What a budget-holder should ask their team
1. Where do employees and applications send AI requests? Ask for an inventory of the API keys and subscription accounts the organisation holds, and confirm none route through third-party gateways or resold access. A relay carries the requests passed through it, and sub2api includes prompt auditing.
2. If we provide AI-enabled services, which of our controls assume the account holder is the person using the service? Rate limits, regional restrictions and abuse detection are the controls Team Cymru names.
3. Can we see outbound connections to infrastructure Team Cymru has associated with relay services, and who owns that review?
4. What do our AI vendor contracts say about credential sharing and resale, and what would we need from the provider to investigate suspected misuse of our account?
