Pull to refresh
Logo
Daily Brief
Following Why Sign Up
Researchers uncover vast AI relay network masking Chinese activity

Researchers uncover vast AI relay network masking Chinese activity

New Capabilities

Team Cymru finds 80,000+ gateway servers hiding AI users, enabling possible model distillation

Today: Team Cymru publishes relay network report

Overview

Updated 1 hour ago

A security firm has uncovered a network of more than 80,000 proxy servers that mask the origin of AI requests flowing to Western frontier labs. The relays pool AI accounts and issue their own keys, so providers see only the intermediary — not who is actually querying the models.

Team Cymru published its findings October 1 after an eight-day scan first detected 10,867 relays, a number it later revised to over 80,000. Traffic traced largely to China and Hong Kong, and one cluster showed a traffic pattern consistent with mass model distillation — harvesting one lab's outputs to train a competitor's model, a practice major providers prohibit.

Why it matters

If Chinese labs distill frontier-model capabilities through these relays, U.S. AI firms lose their competitive edge — and their safety controls.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

80,000+
Relay servers identified
Team Cymru revised its estimate from 10,867 after broadening its search.
58:1
Outbound-to-inbound traffic ratio to Anthropic
Possible sign of mass query preparation for model distillation, per Team Cymru.
16,000
Extraction requests over two days
Linked to Moonshot AI associates, disrupted by OpenAI on July 28.
457
Networks hosting relays
No single hosting provider accounted for more than about 11% of relays.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

F
Fisher
Security researcher, Team Cymru
Co-authored the relay network report

Organizations Involved

Team Cymru
Team Cymru
Security research firm
Identified 80,000+ relay servers, shared addresses with AI providers

Security research firm that tracks malicious internet infrastructure and publishes threat reports.
OpenAI
OpenAI
AI research and deployment company
Disrupted extraction campaign linked to Moonshot AI associates

Developer of the GPT model family, targeted by reasoning extraction attempts.
Anthropic
Anthropic
AI research and deployment company
Targeted by relay network traffic

Developer of the Claude model family, a target of the relay infrastructure.
Moonshot AI
Moonshot AI
Chinese AI startup
Linked to extraction campaign against OpenAI

Chinese AI startup, developer of the Kimi assistant, linked by OpenAI to extraction activity.
Cybersecurity and Infrastructure Security Agency (CISA)
Cybersecurity and Infrastructure Security Agency (CISA)
US federal agencies
Issued joint advisory on China-based distillation campaigns

US cybersecurity and intelligence agencies that warned of Chinese AI distillation campaigns.

Timeline

July 2026 October 2026

6 events Latest: Today
Tap a bar to jump to that date

  1. Team Cymru publishes relay network report

    Today Publication

    Report revises relay estimate to 80,000+; shares identified addresses with affected AI providers.

  2. CISA, NSA, FBI warn of Chinese AI distillation

    Government Advisory

    Joint advisory says China-based AI firms run large-scale distillation campaigns against U.S. models.

  3. Team Cymru completes eight-day scan of relay servers

    Investigation

    Scan detects 10,867 relay servers; one cluster showed 4,000+ Chinese IPs connecting to 304 relays.

  4. OpenAI fully disrupts extraction campaign

    Security Response

    Campaign fully disrupted; company links core activity to Moonshot AI associates.

  5. Extraction attempts spike to 16,000 requests

    Security Incident

    Over 4,000 users attempt extraction in two days; OpenAI identifies related activity across 15,000+ users.

  6. OpenAI detects reasoning extraction attempts

    Security Incident

    Low-volume attempts to extract protected reasoning begin, later linked to Moonshot AI associates.

Scenarios

1

AI providers blacklist relay nodes, forcing operators to rebuild

Likely Resolves by Q1 2027

Discussed by: Team Cymru report; affected AI providers

Team Cymru shared identified relay IP addresses with OpenAI, Anthropic, and other providers. If providers integrate relay detection into their abuse systems, they can block known nodes and flag pooled accounts. Operators would face rising costs to rebuild infrastructure, slowing distillation efforts. The fight would resemble ongoing battles against proxy networks and botnets.

2

Content analysis confirms large-scale model distillation

Possible Resolves by Jan 31, 2027

Discussed by: Team Cymru; CISA/NSA/FBI joint advisory

Team Cymru could not inspect prompts or model responses, so the 58:1 outbound-to-inbound ratio to Anthropic remains unconfirmed as distillation. If researchers gain access to traffic samples, or providers release analysis of what the relays were querying, the scale of distillation could be established. The September joint advisory already signals U.S. agencies regard Chinese distillation as a serious threat.

3

Relay network persists despite takedown efforts

Possible Resolves by Q2 2027

Discussed by: Security researchers tracking the infrastructure

The relays run on open-source gateway software, sit across 457 networks, and no single hosting provider accounts for more than 11% of them. That decentralization makes takedowns difficult — blocking one provider or IP range leaves hundreds of others. Operators can rotate infrastructure the way proxy networks and botnets do. Team Cymru says it continues to search for new nodes.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

October 2022

US-China semiconductor export controls (2022)

The U.S. Department of Commerce imposed export controls restricting China's access to advanced AI chips and chipmaking equipment. The rules targeted chips used for AI training and high-performance computing.

Then

Chinese AI labs faced hardware constraints, spurring domestic chip development and alternative approaches.

Now

The controls framed the broader U.S. strategy of limiting China's access to advanced AI capabilities, of which model weights and trained systems are now the next frontier.

Why this matters now

The relay network bypasses restrictions on who can access U.S. AI models. Distillation lets Chinese labs extract model capabilities even when denied direct access — the software equivalent of smuggling chips.

January 2021

Emotet botnet dismantlement (2021)

Law enforcement agencies from the U.S., Europe, and other nations coordinated to dismantle Emotet, one of the largest botnets, which used distributed proxy infrastructure to mask malicious activity across hundreds of thousands of infected machines.

Then

The infrastructure was taken down in a coordinated operation, disrupting credential theft and malware distribution worldwide.

Now

Emotet briefly resurfaced months later before being dismantled again, showing how distributed infrastructure can revive even after takedowns.

Why this matters now

The AI relay network mirrors Emotet's decentralized design. Its operators can rotate nodes across hundreds of hosting providers, and takedowns may only slow — not stop — the abuse.

Sources

(10)
+4
Risky Business Meterpreter Pivot News News4Hackers CNBC The Hacker News The Decoder Tom's Hardware Reuters Proofpoint