Anthropic does not sell Claude in China. On its map of supported countries, China is a blank space, and the company has built one of the industry's strictest walls to keep it that way: overseas phone numbers, foreign credit cards with matching billing addresses, a ban on any firm more than half-owned from an unsupported region, and, since April, live selfie-and-passport identity checks for flagged users. And yet Chinese developers use Claude every day, often paying as little as a tenth of the official price. A detailed account published this week by the Oxford researcher Zilan Qian, via ChinaTalk, explains how the wall is walked around.
The workaround is called a "transfer station," or zhongzhuanzhan: an overseas proxy server that sits between a Chinese developer and Anthropic's infrastructure, accepts requests, forwards them as though they came from a permitted country, and passes the answer back. The user pays in yuan through WeChat or Alipay and never touches a VPN or a foreign card. Prominent stations are catalogued in public community repositories and ranked by live price and uptime. Functionally it resembles a Western aggregator like OpenRouter. In every way that matters, Qian argues, it is the opposite: built for evasion, routing traffic through middlemen no one can hold to account.
What makes the piece unsettling is the economics, captured in a Chinese phrase: "one fish, three meals." The first meal is a plain markup on bulk-registered or resold accounts, some farmed from free trial credits, some bought with stolen cards. The second is quieter fraud: because the user cannot see which model actually served a request, a proxy can silently route "Opus" to a cheaper tier, or even to a Chinese model, and relabel the output. Researchers at Germany's CISPA audited seventeen proxies and found exactly this, with one "Gemini 2.5" endpoint scoring 37 percent on a medical benchmark against the real API's 84.
The third meal is the one with teeth. Every prompt and every full response passes through the operator's server. For coding agents that means long reasoning chains, real repository context, and human-verified correct answers: an almost ideal dataset for fine-tuning or distilling a rival model. Several developers quoted by Qian say the markup is merely customer acquisition, and that harvesting the logs is where the true margin lies. Users are paying customers and unpaid data suppliers at once. The upstream is grimmer still, with agents recruiting people in lower-income countries to sell their faces and government IDs to clear the biometric checks, credentials that can resurface later in unrelated fraud.
The reason this matters beyond China is that it punctures a core assumption of AI safety. Much of the field treats access control, monitoring, identity checks, and account suspension as a meaningful safeguard against misuse. But a provider that cannot see past the proxy cannot tie a harmful request to a real person, and a banned account can be replaced within hours from an intact supply chain. The same infrastructure a developer uses to reach Claude cheaply is, structurally, the route a determined bad actor would use to reach a frontier model untracked. As governments race to draw control lines along national borders, the grey market is a reminder that the harms rarely respect them.