Faced with strict bans from Anthropic, users in China have continuously found sophisticated ways to "bypass" the system, from exploiting relay infrastructure to using fake identities on Telegram to maintain connectivity.
Anthropic has implemented stringent defense mechanisms to prevent access to its AI models from the Chinese market. However, in reality, these defenses have been consistently breached. Over the past year, startups, research groups, and the tech community in the country have developed sophisticated methods to circumvent the ban and use Claude – which they consider to be the most powerful AI model currently available.
Anthropic will launch in early June 2026. Fable 5 – an optimized version with safety control layers from Mythos, the company's most powerful model. Immediately, Chinese social media exploded with reviews of the tool. Just days later, Anthropic revoked global access, citing export control regulations from the Donald Trump administration.
Users in China can access other Western AI tools like OpenAI's ChatGPT via virtual private networks (VPNs), international phone numbers, and foreign payment methods to create and maintain accounts. However, Anthropic has taken more drastic measures, including proactively blocking accounts suspected of originating from China. On Chinese social media forums, users frequently report that Claude's account was abruptly suspended without warning, despite technical measures to conceal identity being implemented.
The gap between actual usage needs and technical barriers has created fertile ground for a thriving black market. Claude accounts are openly sold on e-commerce platforms like Taobao or through illegal trading channels on Telegram. Recently, the "transfer station" model has emerged as an alternative. These entities act as intermediaries, acquiring Anthropic API access in legitimate regions, then building infrastructure to redistribute it to local users. This model helps startups and professionals maintain more stable and reliable connections compared to traditional methods.
Michael Aciman, a spokesperson for Anthropic, affirmed that the company is continuously upgrading its detection systems, including identity verification processes, to enforce its control policies. Additionally, the company is working to detect and dismantle proxy networks that facilitate unauthorized access.
Despite the challenges, Anthropic's loyal user community in China remains very large, especially among programmers. Although domestic companies like DeepSeek and Z.ai have successfully developed many powerful and competitive large language models (LLMs), independent third-party reviews show that leading closed models from the US, such as Claude, still maintain a performance advantage in some intensive and complex tasks.
Zilan Qian, a researcher at the Oxford China Policy Lab, said that Chinese programmers almost exclusively prefer using Claude Code and OpenAI Codex over domestic products. According to his analysis, Chinese AI models are currently six to nine months behind those in the US. “In programming and software development tasks, the efficiency gap between the two sides is very clear,” Qian stated.
According to Matt Sheehan, a senior fellow at the Carnegie Endowment for International Peace, policymakers and the technical community in China seem unconcerned about the origin of technology. They are willing to adopt ideas and tools from the United States despite existing geopolitical tensions.
Dario Amodei, co-founder and CEO of Anthropic, has frequently emphasized that China's access to frontier AI models poses a serious threat to U.S. national security. Recently, Anthropic accused Alibaba of using output data from Claude to train competing models – a technique known as "distillation." Anthropic also claims that numerous other Chinese companies have engaged in similar practices. For national security reasons, Anthropic does not provide commercial access to Claude in China, nor to Chinese companies operating outside of China.
Nevertheless, users continue to find ways to circumvent the restrictions. For the average user, a common solution is to use a VPN and maintain a fixed proxy location to simulate a stable IP address. Those who are not very tech-savvy often purchase pre-set Claude accounts on e-commerce platforms like Taobao and Xianyu. Although Anthropic constantly scans and locks accounts, this is still considered an acceptable solution for individuals who only need short-term testing or infrequent access.
Ngo Minh Hieu, currently a cybercrime investigator at the non-profit organization "Husband Scammers" (Vietnam), said that similar markets have boomed on Telegram in recent years. According to channels Ngo Minh Hieu and other researchers provided to WIRED, users are selling "Claude Pro" and "Claude Max" accounts, alongside ChatGPT Plus and Gemini Plus packages. These online black markets, using Chinese, particularly focus on "Pro" account packages, allowing users to send a larger number of requests (prompts) compared to regular accounts.
The strong popularity of OpenClaw in China earlier this year created a huge demand for AI agents. Unlike typical chatbots that only respond to messages, AI agents are automated systems capable of performing complex tasks (such as programming or workflow management). Because they have to process massive amounts of data to complete these tasks, they consume many times more "tokens" (the AI's cost unit) than regular chat. For software developers who need to maintain a continuous and stable workflow, finding low-cost and highly reliable sources of access to Claude and the Codex has become a daily necessity.
That's why "transfer stations" were created. Operating on servers located in countries supported by Anthropic, these stations act as intermediaries between Chinese users and Anthropic's system. Instead of logging directly into Claude, users send requests to a local website, and the system forwards those requests to Claude via individual accounts or API keys. After receiving a response from the AI, the transfer station immediately sends the result back to the user. Thanks to this design, users still have a smooth experience as if they were chatting directly with Claude, even though they are actually connecting through an intermediary server. To attract customers, these transfer stations often offer lower prices than buying directly from Anthropic. They can do this by taking advantage of discounts offered to corporate customers or from Anthropic's large distributors, then splitting that value to resell to individual users.
Currently, this demand is so high that numerous websites and GitHub pages (where source code is shared) in Chinese have emerged, specializing in listing and comparing the prices and quality of "relay stations." This market has even attracted prominent figures like cryptocurrency billionaire Justin Sun, who officially opened his own relay station last May to join the game.
The massive number of Chinese users accessing through proxy connections may have skewed statistics on global Claude users. Singapore, with its status as an international economic hub and widespread use of Chinese, is often a prime target for Chinese users to spoof geographical location or route traffic through relay stations. Anthropic data shows that Singapore – a country with only 6 million inhabitants – consistently ranks among the countries with the highest Claude user rates per capita (however, according to this data, the United States remains the country with the largest Claude usage volume in the world).
Anthropic continues to tighten restrictions to prevent users in China and other restricted countries from accessing its services. In April, the company implemented an identity verification process for some Claude users. This process is handled through Persona – a third-party service backed by venture capital firm Founders Fund. Users are required to upload government-issued identification (passport, driver's license, or national ID card) before they can log in. Identification from unsupported countries will not be accepted. If an account fails the verification step, it will be suspended.
This requirement – which Chinese users have compared to the “Know Your Customer” (KYC) procedures of financial institutions – has shifted the underground market from simply trading accounts to a market for fake identities. Over the past few months, Mr. Hieu has observed Chinese-language Telegram channels beginning to advertise Claude accounts that have passed identity verification. “They discuss how to bypass KYC, where to buy Claude identity verification information to maintain access,” Mr. Hieu said.
Perhaps it's time to acknowledge the reality that, no matter how strict Anthropic's geographical restrictions are, as long as these models remain widely available, tech-savvy users in China and restricted areas will always find ways to circumvent them and access Claude. The black markets are always ready to provide turnkey solutions for non-technical users.
However, the inevitable consequence is that accessing Claude through unofficial tools is exposing users to serious security risks. They not only risk being scammed by those selling Telegram accounts, but sensitive information and commands they send through relay stations could also be collected by intermediaries and resold to malicious actors. All of these factors will pose new challenges to AI security.
“"Those working in AI security need to consider: if the infrastructure of these relay stations persists, how do we monitor malicious actors and prevent them from carrying out harmful acts?" Qian asked.
According to Wired – June 26, 2026
English 
Vietnamese