Despite stringent US export controls and strict domestic regulations, Chinese developers are finding creative ways to access the world’s most advanced artificial intelligence models. A thriving grey market of proxy services, known in Chinese developer communities as “transfer stations,” has emerged, allowing tech companies and independent developers in China to access models like Anthropic’s Claude and Google’s Gemini at steep discounts.
According to an analysis by Oxford China Policy Lab researcher Zilan Qian reported by Tom’s Hardware, these transfer stations operate openly on platforms including GitHub, Taobao, and Telegram. They sustain their rock-bottom pricing, often up to 90% below the official API price, through a combination of stolen credentials, model substitution, and harvesting users’ prompts and outputs for resale as AI training data.
The grey market is driven by the persistent performance gap between frontier Western models and their domestic counterparts. While Chinese models like Moonshot AI’s Kimi and Alibaba’s Qwen are highly competitive and rapidly improving, many developers still prefer the nuanced reasoning and coding capabilities of models like Claude 3.5 Sonnet or Gemini 2.5 for specific, complex tasks. The shadow API market bridges this gap, enabling Chinese developers to stay at the cutting edge without waiting for domestic alternatives to fully catch up.
Model Substitution and Data Harvesting
The analysis reveals that the shadow API market is far more deceptive than a simple arbitrage operation. German researchers at the CISPA Helmholtz Center for Information Security and Oxford China Policy Lab researcher Zilan Qian audited 17 of these proxy services and uncovered widespread model substitution. A proxy service marketed as providing access to “Gemini-2.5” scored just 37% on a medical benchmark where the official Gemini 2.5 API scored nearly 84%. Users requesting Claude Opus may instead receive responses from cheaper models such as Claude Sonnet, Haiku, or even domestic Chinese alternatives like Qwen, with the output fraudulently relabeled as the premium model.
The deception does not stop at model substitution. The proxy operators also collect every prompt and response that passes through their servers. For developers using coding agents, this means complete reasoning chains, repository context, and human-verified outputs are being captured and logged without the user’s knowledge. Several Chinese developers told the researchers that the discounted access is essentially a customer acquisition strategy — and that harvesting those logs is the actual business model.
The scale of this data collection is alarming. Datasets of Claude Opus 4.6 reasoning outputs with no clear provenance are already circulating on HuggingFace, suggesting that the harvested data is being actively used to train competing models. This is a form of model distillation that is particularly insidious because it is entirely automated and invisible to the end user.
The Security Risk for Developers
Beyond the deception, the shadow API market poses severe security risks for the developers who use it. Coding agents routinely pass contextual repository data, API structures, and authentication logic through to the model. Developers routing that traffic through an unvetted proxy are essentially sending proprietary source code to a third-party server with no data-handling obligations.
This is not a hypothetical risk. Samsung encountered a version of this problem in 2023 when its engineers pasted proprietary source code into ChatGPT, inadvertently disclosing confidential semiconductor manufacturing data. The proxy services create the same category of risk — but without even the baseline terms of service that major AI providers maintain. For enterprises using these services, the exposure extends to trade secrets, customer data, and internal system architectures.
Complicating US Export Controls
The proliferation of shadow APIs presents a significant challenge to US policymakers attempting to restrict China’s access to advanced AI technology. While Washington has focused heavily on blocking the export of AI chips and manufacturing equipment, controlling the flow of intangible software access via APIs is proving far more difficult.
The White House recently accused China of “industrial-scale” theft of US AI frontier models, highlighting the administration’s growing frustration with technology leakage. The shadow API market is a concrete manifestation of this problem, one that operates in a legal grey area, exploiting the inherent openness of the global internet rather than engaging in direct espionage.
For Western AI companies, the situation is a constant game of whack-a-mole. When one transfer station is blocked, several others quickly emerge. The commercial incentive is strong: operators charge a premium over their costs while bearing relatively low operational risk, and the data-harvesting business provides a secondary revenue stream that makes the entire operation highly profitable.
Domestic Regulatory Risks
The shadow API market also poses significant risks for the Chinese developers who use it. Beijing maintains strict control over the domestic internet, requiring all generative AI services available to the public to undergo security assessments under the Interim Measures for the Management of Generative AI Services. Applications built on unapproved foreign models via shadow APIs operate entirely outside this regulatory framework.
The new draft regulations on agentic AI from the Cyberspace Administration of China (CAC) require developers to maintain detailed logs of an agent’s actions. For developers using shadow APIs, maintaining such logs while also concealing the use of an unapproved foreign model creates an additional layer of legal and operational complexity. If discovered, developers face severe penalties, including the immediate takedown of their applications and potential legal action.
A Symptom of the Broader AI Divide
The shadow API phenomenon is ultimately a symptom of the deepening US-China AI divide. As the two nations increasingly decouple their technology ecosystems, developers on both sides are finding creative ways to bridge the gap. In China, this means transfer stations. In the US, it means the growing adoption of open-source Chinese models like DeepSeek V4, which are now available on Microsoft Azure AI Foundry.
As long as a performance gap exists between the absolute frontier of Western models and their domestic counterparts, the grey market for shadow APIs is likely to persist, serving as a hidden bridge across the widening US-China AI divide and a reminder that in the world of software, geopolitical boundaries are far harder to enforce than physical ones.